feat(channels): add channels enable wechat for one-command, no-portal setup

[acedatacloud-dev]

What

Setting up a WeChat gateway required either the interactive channels portal or
hand-editing channels.toml — and a missing/empty instance_id there is a
common footgun (config error: [[channels.wechat]] #0: required field 'instance_id' is missing or empty). There was also no env-var path for
base_url, so a pure-env deploy was impossible.

Add coding-bridge channels enable wechat — writes a valid, enabled
[[channels.wechat]] block non-interactively:

export WECHAT_BASE_URL=https://<id>.wisdom.acedata.cloud   # or --base-url
export WECHAT_TOKEN=<token>
coding-bridge channels enable wechat        # writes channels.toml, no editor
coding-bridge channels doctor && coding-bridge channels start

• Resolves base_url from --base-url or WECHAT_BASE_URL; instance_id from
  --id / WECHAT_INSTANCE_ID / derived from the gateway host; token_env from
  --token-env / WECHAT_TOKEN_ENV (default WECHAT_TOKEN).
• Creates channels.toml at 0600 if missing; otherwise merges by
  instance_id, preserving every other channel and, on update of an existing
  instance, preserving its other fields (allowed_senders/groups, rate limits,
  approval, provider) — only --sender overrides the allowlist.
• Validates base_url up front (http/https, has host, rejects
  user:pass@host) so it never persists a URL the loader would later reject.
• Idempotent; refuses to edit an already-invalid file.

Tests / evidence

tests/test_channels_cli.py::TestChannelsEnable — 11 cases: create-from-flag,
env fallback, missing-url error, idempotent update, restriction-preservation on
re-run without --sender, non-http reject, embedded-credentials reject,
full-host id derivation, other-instance preservation, invalid-existing refusal,
0600 perms. Full test_channels_cli.py green (34 passed); ruff clean.

Live, against a real *.wisdom.acedata.cloud gateway:

coding-bridge channels enable wechat   -> Enabled wechat instance 'wisdom-…'
coding-bridge channels doctor          -> [OK] token accepted, 43 bytes

🤖 对抗评审

Reviewer: Codex (round 1) → Claude general-purpose subagent (round 2,
after Codex hit a mid-review timeout — see memory codex-exec-stdin-gotcha).

Round 1 found 5 RISKs, all fixed with tests:

1. base_url written before validation → now validated first (http/https, host,
   no embedded creds); rc=1 without writing.
2. Update-by-id replaced the whole instance with defaults → now
   dataclasses.replace on the prior instance; --sender optional.
3. _derive_instance_id collapsed non-wisdom hosts to the first label
   (foo.example.com == foo.other.com) → now full host, dots→dashes.
4. Frontend snippet's bare export broke on Windows → PowerShell pair (paired PR).
5. Snippet didn't note the min version → now >= 2026.7.23 (paired PR).

Round 2 (re-review) verified all five and hunted for new defects (frozen-dataclass
replace, IPv6/empty-host edges, TOML injection via id/url): VERDICT: CLEAN.