feat(line): full [line] section — credentials + connection config-first

[chaodu-agent]

What problem does this solve?

First platform slice of the config-first parity umbrella #1375: LINE's channel credentials were env-only (LINE_CHANNEL_SECRET / LINE_CHANNEL_ACCESS_TOKEN), violating the invariant that every platform setting resolves [section] config → PLATFORM_* env → default with config always winning.

Proposed Solution

Mirrors the TelegramConfig reference pattern end-to-end:

Layer	Change
core config.rs	LineConfig gains channel_secret, channel_access_token, webhook_path; resolve() applies config → LINE_* env → default per field (empty-string ${} expansion falls through to env)
gateway lib.rs	GatewayLineConfig bridge + AppState::apply_line_config() (keeps the crate free of openab-core); new line_webhook_path state; standalone gateway honors LINE_WEBHOOK_PATH and mounts at the resolved path
unified main.rs	Applies [line] before warn_unenforceable_l1, so a config-supplied channel_secret satisfies the #1373 L1 startup check; route mounts at the resolved path
docs	config.toml.example, config-reference.md field table, line.md ([line] primary, env fallback)

Backward compatible: env-only deployments resolve identically; default mount path unchanged.

Tests

• line_section_parses_from_toml — new fields parse
• line_resolve_all_scenarios — 3 new scenarios: config-wins-over-env for all three fields; empty-string expansion falls through to env; nothing set → defaults
• apply_line_config_overrides_env_state_and_feeds_l1_warning — pins the feat(gateway): warn when webhook L1 auth is unenforceable (#1356 Phase 1) #1373 integration: env-derived flagged state clears once config supplies the secret

Validation

At head (macOS arm64, main 9af9fcd):

• cargo clippy -p openab-core -p openab-gateway --all-features -- -D warnings — clean; gateway no-features also clean
• cargo check --features unified and default — pass
• core line tests 16/16; gateway l1_audit tests 5/5
• rustfmt --check isolated per file: zero drift vs main (all three files 0→0)

Closes #1376. Refs #1375 (umbrella), #1373 (L1 warning integration).

[chaodu-agent]

Note

LGTM ✅ — Clean config-first parity slice; mirrors TelegramConfig pattern end-to-end with proper test coverage.

What This PR Does

LINE channel credentials (channel_secret, channel_access_token) and webhook_path were env-only, violating the config-first invariant that every platform setting resolves [section] config → LINE_* env → default. This PR promotes them to first-class [line] TOML fields, completing config-first parity for the LINE adapter (#1376).

How It Works

Mirrors the TelegramConfig reference pattern exactly:

1. core config.rs: LineConfig gains three new Option<String> fields; resolve() applies the config → env → default chain with empty-string filtering for ${} expansion of unset vars.
2. gateway lib.rs: GatewayLineConfig bridge struct + apply_line_config() method keeps the crate free of openab-core; line_webhook_path added to AppState; standalone serve() reads LINE_WEBHOOK_PATH env.
3. unified main.rs: Applies [line] config before warn_unenforceable_l1, so config-supplied channel_secret satisfies the L1 startup check; route mounts at the resolved path.
4. docs: config.toml.example, config-reference.md, and line.md all updated.

Findings

#	Severity	Finding	Location
1	🟢	Correct ordering: apply_line_config before warn_unenforceable_l1 prevents false L1 flagging	src/main.rs:877
2	🟢	Empty-string filter for ${} expansion is identical to Telegram's pattern — correct fallthrough	config.rs:828-846
3	🟢	Tests consolidated in single function to avoid env-var race conditions (cargo parallel test model)	config.rs
4	🟢	New apply_line_config_overrides_env_state_and_feeds_l1_warning test directly pins the L1 integration contract	lib.rs:l1_audit_tests
5	🟢	Standalone gateway also handles LINE_WEBHOOK_PATH with correct #[cfg] gating for non-line builds	lib.rs:serve()

What's Good (🟢)

• Pattern fidelity: Every change mirrors the existing TelegramConfig implementation 1:1 — struct shape, resolve logic, empty-string semantics, gateway bridge pattern, unified integration point. Minimal cognitive overhead for future reviewers.
• Backward compatibility: Env-only deployments resolve identically since None config fields fall through to env vars. No breaking changes.
• Test coverage: Three distinct scenarios (config-wins, empty-expansion-fallthrough, nothing-set-defaults) plus the gateway L1 integration test. Comprehensive for the feature scope.
• Doc consistency: All three documentation surfaces updated simultaneously — example config, reference table, and platform guide.

Baseline Check

• PR opened: 2025-07-13 by chaodu-agent on branch feat/1376-line-config-first
• Main already has: LineConfig with allow_all_users + allowed_users (L3 trust fields only); credentials are env-only (LINE_CHANNEL_SECRET, LINE_CHANNEL_ACCESS_TOKEN); webhook path hardcoded to /webhook/line
• Net-new value: Promotes credentials and webhook path to config-first fields with the standard resolution chain, completing the config-first invariant for LINE

5️⃣ Three Reasons We Might Not Need This PR

1. Credentials in TOML is a security surface — Putting secrets in config.toml (even with ${} expansion) means the file itself becomes sensitive. Counter: the same pattern already ships for Telegram, and ${} expansion means operators can still reference env vars without literals.

2. Webhook path flexibility is rarely needed — Most deployments use the default /webhook/line and never change it. Counter: the unified config-first invariant requires all platform fields to be configurable; parity itself is the value, and the cost is near-zero.

3. Standalone gateway doesn't benefit from TOML config — The serve() path only reads env vars, not TOML. Counter: this is the existing architectural contract (config parsing lives in unified mode); standalone operators use env vars by design and this PR correctly adds LINE_WEBHOOK_PATH env support there too.