feat: 管理面板补齐(RAG导入/记忆添加/会话接history/诚实表述) + design/16 §4.6 IM多会话隔离+第三方身份+黑白名单

agent-98 面板批次:
- 会话管理面板改接 history.ListSessions(主web+次级) + 新建次级会话按钮
- 记忆面板手动添加入口 POST /admin/memories(owner)
- 知识库真正实现 IndexDocument(分块+落projectindex) + POST /admin/rag 导入端点
- 三面板空态诚实表述(去除'后端M10+提供')
- RAG嵌入降级到keyword/line(无直属embedder,不伪造语义,符合红线)

agent-99 design/16 §4.6:
- model.Message.SenderName + 迁移0006 sender_name 列
- 第三方身份边界: session.ResolveActor判定(非LLM猜) + [第三方·昵称]前缀(不改源content)
- 群聊/陌生人落独立sess-xxx(persistIsolated),不写主会话,不广播
- 黑/白名单(allowGroups/denyGroups/allowUsers/denyUsers)最前拦截,不进LLM
- 多账号 CHANNELS_JSON 配置 + 每平台多实例
- 管理只读 GET /admin/channels/{platform}/messages(该平台非主人消息流)

实机验证(JWT): 会话管理返回主会话web / 记忆添加成功 / RAG导入documents非空+Cyrene命中; 后端build/vet/test全绿 + 前端build绿

internal/config/channels.go

@@ -0,0 +1,34 @@
+package config
+
+import (
+	"encoding/json"
+	"fmt"
+	"strings"
+)
+
+// ParseChannelAccounts decodes the CHANNELS_JSON value into a per-platform list
+// of ChannelAccount. The wire shape is map[platform]→[]ChannelAccount, for
+// example:
+//
+//	{"telegram":[{"id":"conf0","config":{"bot_token":"..."},"denyUsers":["12345"]}]}
+//
+// An empty/blank input yields an empty (non-nil) map so a caller can iterate it
+// unconditionally. A malformed JSON or a non-array account value returns an
+// error so a bad config fails loudly at boot rather than silently dropping
+// channels.
+func ParseChannelAccounts(raw string) (map[string][]ChannelAccount, error) {
+	if strings.TrimSpace(raw) == "" {
+		return map[string][]ChannelAccount{}, nil
+	}
+	var m map[string][]ChannelAccount
+	dec := json.NewDecoder(strings.NewReader(raw))
+	if err := dec.Decode(&m); err != nil {
+		return nil, fmt.Errorf("config: decode CHANNELS_JSON: %w", err)
+	}
+	// Tolerate a top-level array of accounts that all share a blank platform name
+	// by normalizing a nil map to an empty one.
+	if m == nil {
+		return map[string][]ChannelAccount{}, nil
+	}
+	return m, nil
+}