feat(daemon): support hot-reloadable channels

[qqqys]

What to build

Make qwen serve own channel runtime management. On startup, the daemon should load workspace settings.channels and connect configured DingTalk, Feishu, WeChat, Telegram, QQ Bot, and extension channels. While running, authenticated daemon HTTP clients should be able to add, update, delete, and restart channel configs, with changes persisted to workspace settings and applied immediately.

Confirmed behavior

• Startup loads workspace settings.channels and connects each configured channel independently.
• Dynamic changes persist to workspace settings, not global user settings.
• First version exposes daemon HTTP APIs only; no WebShell UI yet.
• PUT writes config first, then applies it. If connect fails, the new config remains persisted and runtime status becomes error.
• Daemon-hosted channels default to sessionScope: "thread" unless explicitly configured.
• Channel-created daemon sessions are tagged with source/channel/chat/thread/sender metadata where available.
• Tool permission requests stay in daemon sessions for WebShell or SDK clients to approve; no in-chat approval buttons in v1.
• Channel connection failures do not prevent daemon startup.
• Sensitive config values may be persisted for compatibility, but read APIs return masked values.
• Existing qwen channel start behavior remains unchanged in v1.

Proposed API

GET    /workspace/channels
PUT    /workspace/channels/:name
DELETE /workspace/channels/:name
POST   /workspace/channels/:name/restart
GET    /workspace/channels/:name/status

Acceptance criteria

• qwen serve starts channel runtime management and connects workspace-configured channels without blocking daemon startup on individual channel failures.
• Authenticated clients can list, upsert, delete, and restart workspace channels through daemon HTTP APIs.
• Runtime status reports connecting, connected, disconnecting, disconnected, or error, with lastError for failures.
• Channel config writes use workspace .qwen/settings.json and preserve sensitive values while masking them in API responses.
• Channel-originated prompts create or attach daemon sessions visible to normal daemon clients, with channel metadata.
• Existing qwen channel start behavior is unchanged.
• Focused unit/integration tests cover startup, hot update, delete, restart, masking, auth enforcement, and session metadata.

Design

Local design doc: .qwen/design/2026-06-29-daemon-channel-hot-reload.md

[qqqys]

Superseded by upstream issue: QwenLM#6010