feat(gateway): webhook 渠道 InboundHandler 挂载到网关（渠道遗留2）

让 webhook 渠道的入站 HTTP 回调真正进运行时（此前 handler 建了但未挂载，回调不达 runtime）。

- channelbridge：Bridge.WebhookHandlers() map[string]http.Handler——遍历适配器，对暴露
  InboundHandler()/Config() 的（*webhook.Adapter）收集 endpointPath→handler。
- gateway/server.go：Deps 加 Webhooks map[string]http.Handler；Server 存 webhooks；
  Handler() 挂载到 mux（无网关鉴权，各 handler 自带 HMAC 签名校验）。
- gateway/static.go：spa 加 isWebhookRoute——已注册的 webhook 路径交给 API mux（否则被 SPA
  fallback 吞成 index.html，webhook 回调不达）。
- wire.go：gateway.Deps 传 Webhooks: a.channelBridge.WebhookHandlers()（wireChannels 在
  wireFrontend 前执行，bridge 已建好）。

实机验证：POST /webhook 空体→bad_request(400,webhook 解码响应非 SPA)、带 JSON→accepted(200)、
GET /webhook 被 webhook 路由处理。go build/vet/test 全绿。

internal/services/gateway/server.go

@@ -199,6 +199,12 @@ type Deps struct {
 	// When nil the gateway serves no static assets (API and WS only). The
 	// embedded dist (internal/webui) or an external dist directory is used.
 	Frontend fs.FS
+	// Webhooks are externally-mounted inbound HTTP handlers (endpoint path →
+	// handler), typically from channel adapters that receive webhook callbacks
+	// (e.g. webhook). Each is mounted on the ServeMux without gateway auth; the
+	// handler itself enforces its own signature/authorization (webhook HMAC).
+	// Optional.
+	Webhooks map[string]http.Handler
 }
 
 // Server is the gateway. It owns a ServeMux aggregating REST + WS + admin and a
@@ -222,6 +228,7 @@ type Server struct {
 	voice       VoiceService
 	streaming   bool
 	frontend    fs.FS
+	webhooks    map[string]http.Handler
 	log         *slog.Logger
 	hub         *hub
 }
@@ -254,6 +261,7 @@ func New(cfg *config.Config, deps Deps) (*Server, error) {
 		rag:         deps.RAG,
 		streaming:   deps.Streaming,
 		frontend:    deps.Frontend,
+		webhooks:    deps.Webhooks,
 		log:         sourcedLog(deps.Log),
 	}
 	s.hub = newHub(s)
@@ -297,6 +305,15 @@ func (s *Server) Handler() http.Handler {
 	mux.Handle("POST /api/v1/admin/rag/delete", adminAuth(http.HandlerFunc(s.adminDeleteRag)))
 	mux.Handle("POST /api/v1/admin/plugins/policy", s.auth.Authorize(auth.RoleOwner)(http.HandlerFunc(s.adminSetPolicy)))
 
+	// External webhook callbacks (e.g. the webhook channel) are mounted without
+	// gateway auth; each handler enforces its own signature/authorization.
+	for path, hdl := range s.webhooks {
+		if path == "" {
+			continue
+		}
+		mux.Handle(path, hdl)
+	}
+
 	var h http.Handler = mux
 	if s.frontend != nil {
 		h = s.spa(h)