docs(bot): sync gateway config example with #1640 security defaults

[r266-tech]

Description

Sync the bot.gateway config example and notes in bot/docs/rfc-openviking-cli-ov-chat.md with the security defaults introduced by #1640 (fix(bot):Fix bot api-channel auth check, merged 2026-04-22):

1. Example host default changed from "0.0.0.0" to "127.0.0.1" — matches the new GatewayConfig.host default in bot/vikingbot/config/schema.py and the hardened server startup path in openviking/server/bootstrap.py.
2. Added the new token: "" field to the example — GatewayConfig.token is the canonical replacement for the deprecated api_key, and is used for the X-Gateway-Token proxy auth header.
3. Extended the bot.gateway bullet to describe the fail-fast contract (requires_gateway_token): when the gateway binds to a non-localhost host, a non-empty token is mandatory or startup fails.

Without this doc sync, users copy-pasting the sample JSON from the RFC will (a) accidentally bind the gateway to 0.0.0.0 contrary to the new safe default, and (b) hit the fail-fast token check at startup with no docs context.

Related Issue

Docs drift from #1640 (merged 2026-04-22 by @chenjw). No open issue.

Type of Change

• Documentation update

Check of the Task

• No functional change — docs-only
• Reviewed the PR fix(bot):Fix bot api-channel auth check #1640 diff (schema.py GatewayConfig, server/config.py load_bot_gateway_token, server/bootstrap.py fail-fast) to confirm the new contract
• Local grep confirms bot/docs/rfc-openviking-cli-ov-chat.md is the only doc carrying the now-outdated bot.gateway example (bot/docs/CHANNEL.md does not reference bot.gateway)

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ✅ 1640 - Fully compliant Compliant requirements: Sync documentation with the new defaults and requirements

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🏅 Score: 100

🧪 No relevant tests

🔒 No security concerns identified

✅ No TODO sections

🔀 No multiple PR themes

⚡ No major issues detected

[github-actions]

PR Code Suggestions ✨

No code suggestions found for the PR.

[qin-ctx]

thanks!