feat: independent Feishu employee bot identities

[0YHR0]

Summary

• Explicitly opt-in independent application bot identities for exact pinned employee Run IDs; Task and approval summaries keep the original bot.
• Add a bounded, private operator credential file bound to one deployment tenant and group. Reject duplicate identities, App IDs, insecure POSIX permissions and ambiguous JSON without echoing credentials.
• Preserve stable delivery UUIDs, per-client token caches and shared pacing. Configured sender failures never silently impersonate the summary bot. Unmapped fallback is explicit and can be disabled.
• Keep bot registration/user approval outside the runtime and document official one-click onboarding, group membership and safe restart/remapping limits in English and Chinese.

Validation

• 79 focused Feishu tests passed; one POSIX permission test skipped on Windows (runs on Linux CI).
• Ruff, diff checks and existing notification regression passed.
• The complete non-PostgreSQL suite and all GitHub CI checks passed (including PostgreSQL, Compose E2E and CodeQL).
• Deployed to the private stack: notifier loaded an exact employee binding from its read-only protected file; API readiness remained healthy.
• Live user-confirmed independent app credentials recovered and encrypted on the local operator machine. Token and bot identity checks passed. Group send qualification depends on adding the new bot to the owner's existing controlled test group; Feishu disallowed invitation by another application even after that application had member-management permission.

No credentials, private deployment addresses or operator registration URLs are committed.