fix(weixin): 空token''连接''不再阻塞+409请先扫码登录；Connect空token返回ErrNeedsLogin

面板点''连接''此前触发阻塞式扫码(最长8min)不展示二维码→挂起。修:
- weixin adapter Connect: 空token返回 ErrNeedsLogin(非阻塞), 扫码走独立 login-qr/login-status
- adminChannelOpen: errors.Is(ErrNeedsLogin)→409'该渠道尚未登录:请先扫码登录再连接'(不再500/挂起)
- login_test.go 改用 StartLogin/LoginStatus 驱动(与旧Connect阻塞行为解耦)
build/vet/test 全绿, 已部署.

internal/services/gateway/admin_write_llm_channels.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"errors"
 	"context"
 	"encoding/json"
 	"net/http"
@@ -16,6 +17,7 @@ import (
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/model"
 	"git.yeij.top/AskaEth/Cyrene_v2/internal/user"
 	"git.yeij.top/AskaEth/Cyrene_v2/pkg/plugins/sdk"
+	"git.yeij.top/AskaEth/Cyrene_v2/plugins/channels/weixin_ilink"
 )
 
 // LLM-provider and channel-lifecycle admin writes (owner-only, audited). The LLM
@@ -191,6 +193,12 @@ func (s *Server) adminChannelOpen(w http.ResponseWriter, r *http.Request) {
 	}
 	if err := ch.Connect(r.Context()); err != nil {
 		s.auditClaims(r, "channel.open", "error")
+		// weixin-iLink with no token yet must not hang nor read as a credential
+		// error: the panel routes the owner to the out-of-band 扫码登录 flow.
+		if errors.Is(err, weixin_ilink.ErrNeedsLogin) {
+			writeError(w, apperr.Wrap(apperr.ErrConflict, "needs_login", "该渠道尚未登录：请先用「扫码登录」绑定，再连接"))
+			return
+		}
 		s.log.Error("channel open", "name", name, "err", err)
 		writeError(w, apperr.Wrap(apperr.ErrInternal, "channel_connect_failed", "connect failed (check credentials): %s", err.Error()))
 		return