feat: 管理面板补齐(RAG导入/记忆添加/会话接history/诚实表述) + design/16 §4.6 IM多会话隔离+第三方身份+黑白名单

agent-98 面板批次:
- 会话管理面板改接 history.ListSessions(主web+次级) + 新建次级会话按钮
- 记忆面板手动添加入口 POST /admin/memories(owner)
- 知识库真正实现 IndexDocument(分块+落projectindex) + POST /admin/rag 导入端点
- 三面板空态诚实表述(去除'后端M10+提供')
- RAG嵌入降级到keyword/line(无直属embedder,不伪造语义,符合红线)

agent-99 design/16 §4.6:
- model.Message.SenderName + 迁移0006 sender_name 列
- 第三方身份边界: session.ResolveActor判定(非LLM猜) + [第三方·昵称]前缀(不改源content)
- 群聊/陌生人落独立sess-xxx(persistIsolated),不写主会话,不广播
- 黑/白名单(allowGroups/denyGroups/allowUsers/denyUsers)最前拦截,不进LLM
- 多账号 CHANNELS_JSON 配置 + 每平台多实例
- 管理只读 GET /admin/channels/{platform}/messages(该平台非主人消息流)

实机验证(JWT): 会话管理返回主会话web / 记忆添加成功 / RAG导入documents非空+Cyrene命中; 后端build/vet/test全绿 + 前端build绿

internal/runtime/model/model.go

@@ -55,6 +55,13 @@ type Message struct {
 	// Content carries one or more parts. A text-only message uses a single
 	// ContentTypeText part.
 	Content []Content
+	// SenderName is the human-readable display name of the message's sender
+	// (design/16 §4.6). It is transport metadata used by the context-assembly
+	// layer to label third-party messages for the model (e.g. "[第三方 · 昵称]"),
+	// never a substitute for the strongly typed sender identity carried on the
+	// channel layer. Empty means the sender is unlabeled (the owner, or an
+	// unknown/unresolved sender), and callers may leave it unset.
+	SenderName string
 	// ToolCallID and ToolCallName are reserved as interface-level placeholders
 	// for the M2 tool loop; they are ignored by current adapters.
 	ToolCallID   string