feat(channels): add QQ QR binding and group context

[Pandakingxbc]

Summary

• add QQ QR-code binding to the API, CLI, and channel dashboard, including automatic channel save/enable after a successful scan
• add typed, visual QQ group policy controls to the dashboard: policy enablement, message visibility, activation mode, context limit, and clear-after-reply behavior
• preserve the selected group policy through QR binding and fix QQ QR auto-save deduplication
• render short-lived group history into the current agent turn with anonymized member labels and attachment path hints
• preserve the channel conversation ID for routing and cover QQ proactive group replies
• require the published harness-gateway 0.9.1 package and lock it from public PyPI

Why

QQ group conversations need enough recent context for the agent to understand referenced files and prior messages, while keeping the current message clearly identified as the message to answer. The visual controls avoid requiring operators to edit raw JSON, and QR onboarding removes the need to manually copy QQ bot credentials.

Group policy behavior

• Auto: use the visibility authorized by QQ
• Mentions only: respond only to messages that mention the bot, with no history
• Mention + recent: include the configured recent-message window when the bot is mentioned
• All messages: allow the bot to observe the full delivered group stream; operators can additionally choose whether every message activates the agent
• unsafe combinations are normalized (for example, always activation is only retained with all visibility)

Dependency

The implementation uses the group-context and QQ QR-login APIs published in harness-gateway 0.9.1. Both pyproject.toml and uv.lock resolve public releases; no sibling editable source is committed. The merged lock also resolves orcakit-harness-agent 0.9.19 from public PyPI.

Verification

The repository gate completed successfully after merging the latest develop:

• Ruff lint passed
• Ruff format check: 688 files already formatted
• mypy: no issues in 359 source files
• pytest: 1775 passed, 12 skipped, 31 deselected
• dashboard TypeScript and production build passed

A fresh Python 3.12 environment was also synchronized with uv sync --locked --no-sources at the dependency commit and verified against only the committed public lock:

• Ruff lint and format check passed
• mypy passed
• pytest: 1736 passed, 7 skipped, 31 deselected
• live test collection: 31 tests collected without import errors
• dashboard production build passed

GitHub Actions run 31006534837 passed all required jobs:

• Linux / Python 3.12
• Windows / Python 3.12
• Live tests with real credentials

The remaining Vite output consists of existing chunk-size and mixed dynamic/static import warnings; the build exits successfully. GitHub also emitted non-blocking action cache-service and Node.js runtime deprecation annotations.