feat(gateway): consolidate channel gateway foundation and adapters

[esafwan]

Summary

Consolidates the Channel Gateway stack into one reviewable PR against develop.

Source PRs included:

• feat(gateway): add secure channel gateway foundation #441 feat(gateway): add secure channel gateway foundation
• feat(gateway): add adapter SDK contract #446 feat(gateway): add adapter SDK contract
• feat(gateway): bridge adapters to runtime routing #449 feat(gateway): bridge adapters to runtime routing
• feat(gateway): add VK adapter contract #447 feat(gateway): add VK adapter contract
• feat(gateway): add WeCom adapter contract #448 feat(gateway): add WeCom adapter contract
• feat(gateway): add Microsoft Teams outgoing webhook adapter #442 feat(gateway): add Microsoft Teams outgoing webhook adapter
• feat(gateway): add verified Discord interaction ingress #443 feat(gateway): add verified Discord interaction ingress

What Changed

• Adds Gateway, Gateway Binding, Gateway Access Entry, and Gateway Event DocTypes.
• Adds provider-neutral gateway ingress, admission, idempotency, routing, queueing, and execution service.
• Adds Gateway UI navigation, page, and frontend API service.
• Adds Gateway Adapter SDK contracts, value objects, registry, and conformance checks.
• Adds runtime adapter bridge for SDK-based providers and outbound replies.
• Adds VK and WeCom SDK adapters.
• Adds Microsoft Teams outgoing webhook ingress with HMAC verification.
• Adds Discord Interaction ingress with Ed25519 signature verification.
• Adds detailed architecture/security/contract/test/follow-up documentation in docs/gateway-foundation.md.

Conflict Resolution Notes

• Preserved the richer Gateway admission model from the foundation/runtime stack:
  direct_policy, room_policy, room_sender_policy, mention_required, and pairing_ttl_minutes.
• Merged channel options into one consolidated list:
  Telegram, Slack, Discord, Email, WhatsApp, VK, WeCom, Microsoft Teams.
• Preserved both VKGatewayAdapter and WeComGatewayAdapter exports in the SDK package.
• Did not merge older access_policy / allowed_senders schema from the draft Teams/Discord branches because it regressed the newer security boundary.

Security Boundaries

• Provider adapters verify native webhooks before handing events to Huf routing.
• Raw payload evidence is redacted for common secret-bearing keys.
• Gateway execution uses the configured execution_user; administrators should not use Administrator.
• Direct-message pairing creates a pending access request and never executes the triggering message.
• Room admission and sender admission are distinct.
• Missing routes are marked unrouted and do not invoke a model.

Validation

Passed:

• python3 -m compileall huf/ai/gateway_service.py huf/ai/gateway_webhook.py huf/ai/gateway_adapters huf/ai/gateways huf/ai/tools/teams_webhook.py huf/ai/tests/test_gateway_service.py huf/ai/tests/test_gateway_adapter_sdk.py huf/ai/tests/test_gateway_webhook.py huf/ai/tests/test_vk_gateway_adapter.py huf/ai/tests/test_wecom_gateway_adapter.py huf/ai/tests/test_teams_webhook.py huf/ai/tests/test_discord_gateway.py
• yarn eslint src/pages/GatewaysPage.tsx src/services/gatewayApi.ts src/App.tsx src/components/app-sidebar.tsx src/data/doctypes.ts src/layouts/UnifiedHeader.tsx
• python3 -m json.tool huf/huf/doctype/gateway/gateway.json
• Exact conflict-marker scan: rg -n '^(<<<<<<<|>>>>>>>|=======$)' .

Blocked or baseline failures:

• python3 -m pytest ...gateway... could not collect in the host shell because frappe and cryptography are not installed.
• python3 -m ruff check ...gateway... could not run because ruff is not installed in the host shell.
• yarn typecheck fails on existing non-gateway data-table files: DataRecordFormLayout.tsx, FieldConfigPanel.tsx, DataPage.tsx, and DataTableViewPage.tsx.
• yarn lint fails on existing non-gateway files including BulkImportModal.tsx, TestToolDrawer.tsx, DataPage.tsx, and agentApi.ts; gateway-scoped lint passes.
• yarn build fails at the same existing non-gateway TypeScript errors as yarn typecheck.

Follow-Ups

• Run the gateway tests inside a Frappe bench or CI image with frappe and cryptography installed.
• Run migration/browser smoke for the new Gateway DocTypes and Gateway UI page.
• Add provider setup guides after deployment URLs and credential names are finalized.
• Keep source PRs open until this umbrella PR is explicitly approved for merge and parent approval is given to close superseded PRs.

[esafwan]

Tested the consolidated gateway stack on a disposable multihand bench (huf.localhost:8006).\n\nScreenshot of the Gateways page (taken on the original #441 foundation branch, before the UI schema fix):\n\n\nNote: the "Could not load gateways" error in the screenshot is because the frontend requested "access_policy", a field that was dropped from the Gateway DocType in favor of "direct_policy", "room_policy", "room_sender_policy", and "pairing_ttl_minutes" — this consolidation PR fixes that mismatch.\n\nSource PRs included here:\n- #441 foundation\n- #446 adapter SDK\n- #449 adapter runtime bridge\n- #447 VK adapter\n- #448 WeCom adapter\n- #442 Microsoft Teams outgoing webhook\n- #443 Discord interaction ingress