fix: KOOK 连不上根因——空token裸账号不注册/占名 + open指向带token账号 + 前端token不覆盖真值

agent-119 后端:
- buildAccountAdapter: token平台(kook/telegram/weixin)BotToken空→跳过build(不注册不占名), channelAccountsFromEnv 无tokenenv不合成账号(杜绝裸kook id="")
- runtimeconfig cleanAccounts: LoadChannels/SaveChannels 丢弃token平台空token账号(清理channels.json现有裸kook, 下次保存抹掉)
- findChannel: 裸平台名(kook)回退到该平台第一个带token账号, open"kook"不再命中裸的missing token

我补 前端token掩码不就覆真值:
- openConfig 不再把'（已配置，仅掩码显示）'当token回填(setToken空)→save token空不写bot_token保留真值
- 加 tokenHint(显示'已配置留空不改'/重填换); 修之前channels.json kook:3fc8 token变掩码串的bug
全仓 build/vet/test绿+前端build绿(463行)

cmd/cyrene/channels_test.go

@@ -51,6 +51,58 @@ func TestBuildChannelAdapters_KookMultiAccount(t *testing.T) {
 	}
 }
 
+// TestBuildChannelAdapters_SkipsEmptyTokenKookFromFile verifies a stale
+// channels.json with both a bare empty-token kook and a real token account builds
+// only the token account, so the bare "kook" never registers (and never wins a
+// bare-name open).
+func TestBuildChannelAdapters_SkipsEmptyTokenKookFromFile(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "channels.json")
+	raw := `{"kook":[
+		{"id":"","config":{"base_url":"","bot_token":""}},
+		{"id":"3fc8","config":{"bot_token":"real-token"}}
+	]}`
+	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	f := &channelFactory{path: path, fallback: channelAccountsFromEnv(), log: testLog()}
+	adapters := buildChannelAdapters(f)
+	if hasAdapter(adapters, "kook") {
+		t.Fatalf("bare empty-token kook should not be built, got %v", names(adapters))
+	}
+	if !hasAdapter(adapters, "kook:3fc8") {
+		t.Fatalf("expected kook:3fc8, got %v", names(adapters))
+	}
+}
+
+// TestChannelAccountsFromEnv_NoEmptyTokenPlaceholders verifies the env fallback
+// does not synthesize an empty-token kook/telegram/weixin account (only a real
+// token produces the account), so a bare placeholder is never registered.
+func TestChannelAccountsFromEnv_NoEmptyTokenPlaceholders(t *testing.T) {
+	for _, k := range []string{"CHANNEL_KOOK_TOKEN", "CHANNEL_TELEGRAM_BOT_TOKEN", "CHANNEL_WEIXIN_ILINK_BOT_TOKEN", "CHANNELS_JSON"} {
+		t.Setenv(k, "")
+	}
+	env := channelAccountsFromEnv()
+	for _, platform := range []string{"kook", "telegram", "weixin-ilink"} {
+		if _, ok := env[platform]; ok {
+			t.Fatalf("empty-token %s should not be synthesized", platform)
+		}
+	}
+}
+
+// TestChannelAccountsFromEnv_KookPresentWhenTokenSet verifies a set token yields
+// the account.
+func TestChannelAccountsFromEnv_KookPresentWhenTokenSet(t *testing.T) {
+	t.Setenv("CHANNEL_KOOK_TOKEN", "kook-secret")
+	env := channelAccountsFromEnv()
+	list, ok := env["kook"]
+	if !ok || len(list) != 1 {
+		t.Fatalf("expected a synthesized kook account, got %+v", env["kook"])
+	}
+	if list[0].Config["bot_token"] != "kook-secret" {
+		t.Fatalf("bot_token = %v, want kook-secret", list[0].Config["bot_token"])
+	}
+}
+
 func hasAdapter(adapters []adapter.PlatformAdapter, name string) bool {
 	for _, a := range adapters {
 		if a.Name() == name {