fix(gateway): reject known-weak placeholder credentials at startup

[teknium1]

Summary

Port of openclaw/openclaw#64586: rejects known-weak placeholder credentials at gateway startup instead of letting them silently fail against platform APIs.

Problem

When users copy .env.example to .env without changing placeholder values like ***, changeme, or your_api_key, the gateway starts up and attempts to authenticate with the platform API using these values. The resulting error from Telegram/Discord/Slack is confusing and doesn't point to the root cause.

Solution

Platform token validation (gateway/config.py):

• Extracted _validate_gateway_config() from load_gateway_config() for testability
• After the existing empty-token warning, check enabled platform tokens against has_usable_secret() from hermes_cli/auth.py
• Platforms with placeholder tokens are auto-disabled with a clear error log explaining the issue

API server key validation (gateway/platforms/api_server.py):

• When binding to a network-accessible address with an API_SERVER_KEY, check it against has_usable_secret()
• Placeholder keys like changeme or *** are rejected with a helpful error suggesting openssl rand -hex 32
• Existing behavior for localhost (no key required) is unchanged

Architectural Differences from OpenClaw

OpenClaw has a dedicated gateway auth token (OPENCLAW_GATEWAY_TOKEN) that protects the gateway itself. Hermes-agent uses per-platform tokens (Telegram/Discord/Slack bot tokens) + an optional API server key. This implementation:

• Reuses the existing _PLACEHOLDER_SECRET_VALUES set from hermes_cli/auth.py (already contains all the right patterns)
• Auto-disables platforms with placeholder tokens (rather than hard-failing the entire gateway) — other platforms with valid tokens still start
• Hard-fails the API server only when network-exposed with a placeholder key (localhost is fine)

Tests

11 new tests:

• 8 unit tests for platform token placeholder rejection (reject ***, changeme, your_api_key, placeholder; accept real tokens; accept empty; skip disabled; catch whitespace-padded)
• 2 integration tests for API server placeholder key rejection on network hosts
• 1 test verifying loopback with placeholder key is allowed

python3 -m pytest tests/gateway/test_weak_credential_guard.py tests/gateway/test_api_server_bind_guard.py -o 'addopts=' -q