feat(channels): add two-tier channel visibility policy for resellers

[realcodesiman]

Summary

• Lets the platform and individual resellers hide channel types from the create-channel picker and settings accordion, without affecting channels already connected.
• Adds Tenant.hiddenChannels and tenantService.resolveVisibleChannels, unioning the platform's hidden-channel policy with a reseller's own, root-tenant hides always taking precedence.
• Consolidates the previously duplicated inline owner-resolution logic (platform vs. workspace-tenant owner) used by both credential lookup and the new visibility checks into apps/builder/src/lib/platform-credential-owner.ts.
• Introduces packages/utils/src/channel.ts's ChannelCapability registry as the single source of truth for which channels are creatable/manageable/require-a-credential, replacing hardcoded ChannelType[] literals in the create picker and settings accordion that had drifted from each other.

Changes

• Schema/migration: Tenant.hiddenChannels (jsonb, nullable) — packages/database/drizzle/20260810041827_add_tenant_hidden_channels/
• Business logic: tenantService.resolveVisibleChannels (packages/business/src/enterprise/tenant/service.ts), resolveChannelCreatable (apps/builder/src/lib/workspace/resolve-channel-creatable.ts)
• New settings surfaces: /admin/platform-channels, /manage/platform-channels, backed by apps/builder/src/features/platform-channels/ (schema, settings UI, server action)
• UI: new channels-accordion.tsx and add-channel-button.tsx apply the visibility policy to the settings rows and create-channel entry point
• Shared registry: packages/utils/src/channel.ts (ChannelCapability)
• Owner resolution: centralized in apps/builder/src/lib/platform-credential-owner.ts, consumed by channel connect/reconnect/select-account actions across Messenger, Instagram, WhatsApp, Zalo, TikTok, Google Sheets, Facebook Ads/Lead Ads

Test plan

• pnpm lint
• pnpm --filter builder check-types
• pnpm --filter @chatbotx.io/business check-types
• New/updated Vitest suites green: platform-credential-owner, channels-create-visibility-guard, channels-create-platform-owner, settings-channels-visibility, settings-channels-add-button-gating, webchats-create-visibility-guard, add-channel-button, channel-connect-credential-consistency, tenant-channel-visibility (business package)
• Manual: platform admin hides a channel type, confirm it disappears from every reseller's create picker; a reseller hides a channel type, confirm it only disappears for their own sub-accounts
• Manual: confirm already-connected channels of a newly-hidden type keep working (webhooks, send, inbox) — policy is creation-time only

Note: apps/builder/__tests__/channel-route-guards.test.ts has 2 pre-existing failures on main (unrelated targetWorkspace.ownerId mock gap in dashboard tests, verified via git stash against main before this change) — not introduced by this PR.

---

Follow-up: docs + review fixes (65e00e5)

Post-review refinements on top of the feature commit:

• docs/tenancy.md — new "Channel-visibility policy" section (was undocumented): UI-gate-not-authorization, platform/reseller tier union, resolveVisibleChannels rules, grandfathering, and tenant-aware owner resolution (host wins over workspaceId).
• AGENTS.md — invariant #17 create new contact #18 covering the three silent pitfalls (connect actions don't re-check the policy; new gates must pass the tenant-aware owner; new gates must preserve grandfathering). Synced to .devin + copilot mirrors.
• channels/create/page.tsx — corrected an overclaiming comment: the page gates rendering, not the connect actions, so hiding is a UI hint, not access control.
• platform-channels-settings.tsx — guarded toggleChannel against an undefined useWatch value before RHF hydrates defaultValues.