feat(wecom_bot): add callback (webhook) mode alongside long connection

Support receiving WeCom smart-bot messages via encrypted HTTP callback in
addition to the existing WebSocket long connection. Disabled by default
(wecom_bot_callback=false).

- Add wecom_bot_callback / wecom_bot_token / wecom_bot_encoding_aes_key /
  wecom_bot_port config keys
- Add WXBizJsonMsgCrypt-based crypto module for URL verification, callback
  decryption and passive-reply encryption (receive_id empty for internal bots)
- Reply asynchronously via the official stream-refresh polling: register a
  stream id on first reply, accumulate agent output into per-stream state, and
  serve the latest content (text + image) on each poll until finish
- Fall back to EncodingAESKey for media decryption when callback bodies carry
  no per-message aeskey
- Degrade unsupported passive replies (file/voice/video) to a text notice
- Expose the new fields in the Web console channel config

Co-authored-by: Cursor <cursoragent@cursor.com>

channel/web/web_channel.py

@@ -3016,6 +3016,10 @@ class ChannelsHandler:
             "fields": [
                 {"key": "wecom_bot_id", "label": "Bot ID", "type": "text"},
                 {"key": "wecom_bot_secret", "label": "Secret", "type": "secret"},
+                {"key": "wecom_bot_callback", "label": "Callback Mode", "type": "bool", "default": False},
+                {"key": "wecom_bot_token", "label": "Token", "type": "secret"},
+                {"key": "wecom_bot_encoding_aes_key", "label": "EncodingAESKey", "type": "secret"},
+                {"key": "wecom_bot_port", "label": "Port", "type": "number", "default": 9892},
             ],
         }),
         ("qq", {