Harden Feishu local_openapi and webhook test coverage

[ApolloZhangOnGithub]

背景

Feishu bridge 从开发适配器 hermes_lark_cli 扩展到 local_openapi、webhook、setup、watch viewer 和 reply ack。该模块现在包含外部 HTTP、tmux、配置文件 merge、token 校验和命令路由，多数风险来自边界行为，不是普通 happy path。

需要补的测试

• openapi_post 的 HTTP error、invalid JSON、timeout/URLError 降级。
• tenant token 获取失败时 send_reply 不应继续发消息。
• webhook token 同时覆盖 root token 和 header token。
• setup_config 保留其它 TOML section，并验证随机 token/默认端口行为。
• serve_webhook 或 handler 层的最小 request/response 测试，避免只测纯函数。
• start_bridge_daemon/watch viewer 的 tmux command quoting 和 config path 保真。
• hermes_lark_cli legacy path 继续有回归测试，防止兼容性被 local_openapi 改坏。

Acceptance criteria

• 不访问真实 Feishu，不启动真实 tmux，不需要真实 ngrok。
• 使用 monkeypatch/fakes 覆盖 HTTP 和 subprocess。
• python -m pytest tests/test_feishu_bridge.py -q 通过。
• 覆盖失败路径输出 detail，便于用户诊断配置错误。

Parent

Part of #88.

[ApolloZhangOnGithub]

Add requirement: privacy-conscious local Feishu event ledger

From the two-device supervisor discussion: CNB should keep a local audit/recovery record for Feishu routing, but it should not silently become a full Feishu chat database.

Default behavior

Store a minimal event ledger for inbound/outbound Feishu handling:

• message_id, chat_id, sender_id, timestamp, message type;
• routing state: received, delivered to device supervisor, reply/ask sent, done;
• associated local device supervisor, project, board task/issue/runtime event when known;
• attachment/resource handoff metadata: local path, size, content hash, resource type;
• failure/retry/activity state for debugging stuck cards or delivery problems.

Do not persist full chat history or full message bodies by default. Current-message resource handoff remains allowed because the supervisor needs paths to process attachments, but it should have retention/cleanup policy.

Explicit modes

• Normal mode: minimal ledger only.
• Diagnostic mode: readback_enabled=true plus explicit user request, limited by --limit, for history/read-status troubleshooting.
• Archival mode: only when the user explicitly asks to turn a conversation into a project record, issue, daily, or supervisor handoff. Store a curated summary in the correct project/global location, not raw chat logs.

Acceptance additions

• Add tests that inbound events write the minimal ledger without storing full body text by default.
• Add tests that reply, ask, activity start/update/done, and resource handoff update the ledger.
• Add tests that readback remains opt-in and refuses when disabled.
• Add TTL/cleanup design for attachment caches and diagnostic readback artifacts.
• Document the privacy boundary in docs/feishu-bridge.md: local copy means event index, not full Feishu transcript.

This also helps multi-device supervision: device supervisors can prove what was received/handled without syncing private full chat history across machines.

[ApolloZhangOnGithub]

Covered on master in d5d8554 (test: cover Feishu OpenAPI failure paths). Added OpenAPI HTTP error, network failure, non-JSON response, and tenant-token-stop coverage without real Feishu/tmux/ngrok. Verified with python3 -m pytest tests/test_feishu_bridge.py -q and full local suite: python3 -m pytest -q => 1601 passed.