Support Feishu as an external Bot channel

[luw2007]

Problem

OpenBot users in Feishu/Lark cannot talk to a coworker from their existing messaging client. OpenBot currently has no Feishu transport, identity-link flow, or Feishu conversation projection.

A useful integration should preserve OpenBot's existing boundaries rather than introduce a second execution path:

• a Feishu person must link to an OpenBot account before acting
• current OpenBot role and revocation state must be checked on every message
• direct messages may route normally; group messages should run only when the Bot is mentioned
• Feishu tenant, chat, and thread identifiers must not collide with another provider
• duplicate delivery and concurrent turns must not execute twice
• credentials must remain deployment-local rather than pass through browser/chat APIs

Proposed behavior

• Receive im.message.receive_v1 over Feishu's official Node SDK long connection; no public webhook required.
• Reply to direct messages and mentioned group messages through the existing OpenBot turn engine.
• Return a short-lived account-link URL for an unknown Feishu identity.
• Store external identity, conversation binding, message deduplication, and turn serialization in Postgres so behavior survives multiple API replicas.
• Project linked Feishu threads into the existing OpenBot external-thread UI.
• Support multiple Feishu applications through a strict server-local credentials file; unset configuration disables the provider.

Deployment and security constraints

• One long connection starts per configured application on every server replica. Postgres idempotency and locking must make repeated ingress harmless.
• Provider identity remains part of every durable key and projection.
• Acting calls retain the existing resolve, authorize, audit, then act boundary.
• Feishu app secrets are never accepted from the client and are not persisted in application tables.

Prior art and implementation

Slack groundwork is under review in #297. A Feishu implementation based on that external-channel model is available as draft PR #413. The draft is intentionally not marked ready while the Slack prerequisite and current main history are unresolved.

Acceptance criteria

• A linked Feishu user can message an accessible coworker by direct message.
• A group message runs only when the Bot is mentioned.
• An unlinked identity receives a valid account-link URL and cannot act before linking.
• Revoked or unauthorized OpenBot users are refused on later messages.
• Redelivered events produce at most one turn and one outbound reply.
• Slack and Feishu identifiers cannot cross-bind.
• Restarting or adding replicas does not lose identity, thread, or deduplication state.
• Operators can disable Feishu by leaving its configuration unset.