Fix: resolve unexpanded env vars in Slack webhook token

[crarau]

Root Cause

The trigger config in config.ts caches env-var-expanded values via expandEnvVars(). When the cache is populated before the env var is available in process.env (PM2 environment mismatch, startup race condition), the literal string ${ELI_SLACK_BOT_TOKEN} is stored as the token value instead of the real xoxb-... token. This unexpanded string is then sent to Slack as a Bearer token, which returns invalid_auth with no further detail.

This has been silently failing for all Eli channel failure notices since April 29 (every single Slack thread reply to Eli channels has failed).

Fix

• Add resolveSlackToken() in src/lib/webhooks/resolve-slack-token.ts that detects ${VAR} patterns at use time and re-expands from process.env
• Import and use it in the webhook handler instead of raw trigger.slackBotToken || process.env.SLACK_BOT_TOKEN
• Improve error logging to include trigger name and token prefix for faster diagnosis

Alert Reference

Triggered by production alert at 2026-06-25T14:20:02.065Z:
[Slack Webhook] Slack reply failed: invalid_auth thread_ts=1782396209.882939

Testing

• 7 new unit tests for resolveSlackToken covering: normal tokens, fallback env, unexpanded vars with/without env resolution, custom fallback keys
• Full test suite passes (186 tests, 17 files)
• TypeScript check passes (only pre-existing errors in unrelated test file)
• Confirmed manually that sending literal ${ELI_SLACK_BOT_TOKEN} to Slack returns invalid_auth, while the expanded token works