fix: KOOK 连不上根因——空token裸账号不注册/占名 + open指向带token账号 + 前端token不覆盖真值

agent-119 后端:
- buildAccountAdapter: token平台(kook/telegram/weixin)BotToken空→跳过build(不注册不占名), channelAccountsFromEnv 无tokenenv不合成账号(杜绝裸kook id="")
- runtimeconfig cleanAccounts: LoadChannels/SaveChannels 丢弃token平台空token账号(清理channels.json现有裸kook, 下次保存抹掉)
- findChannel: 裸平台名(kook)回退到该平台第一个带token账号, open"kook"不再命中裸的missing token

我补 前端token掩码不就覆真值:
- openConfig 不再把'（已配置，仅掩码显示）'当token回填(setToken空)→save token空不写bot_token保留真值
- 加 tokenHint(显示'已配置留空不改'/重填换); 修之前channels.json kook:3fc8 token变掩码串的bug
全仓 build/vet/test绿+前端build绿(463行)

internal/config/runtimeconfig/channels_test.go

@@ -90,6 +90,72 @@ func TestLoadChannelsEmptyMapFallsBackWithWarn(t *testing.T) {
 	}
 }
 
+func TestLoadChannelsCleansEmptyTokenKook(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), "channels.json")
+	// A stale channels.json holding a bare empty-token kook plus a real account.
+	raw := `{"kook":[
+		{"id":"","config":{"base_url":"","bot_token":""}},
+		{"id":"3fc8ef9434bddfbbe4f4daa8da21c093","config":{"bot_token":"real-token"}}
+	]}`
+	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	accounts, warn := LoadChannels(path, nil)
+	if warn != nil {
+		t.Fatalf("warn = %v, want nil", warn)
+	}
+	kook := accounts["kook"]
+	if len(kook) != 1 {
+		t.Fatalf("kook = %+v, want only the token-bearing account", kook)
+	}
+	if kook[0].ID != "3fc8ef9434bddfbbe4f4daa8da21c093" || kook[0].Config["bot_token"] != "real-token" {
+		t.Fatalf("kook = %+v, want the token-bearing account", kook[0])
+	}
+}
+
+func TestLoadChannelsKeepsNonTokenPlatforms(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), "channels.json")
+	// qq-obv11/webhook carry no bot token and must be preserved.
+	raw := `{"qq-obv11":[{"id":"","config":{"mode":"server"}}],"webhook":[{"id":"","config":{"endpointPath":""}}]}`
+	if err := os.WriteFile(path, []byte(raw), 0o600); err != nil {
+		t.Fatalf("write: %v", err)
+	}
+	accounts, warn := LoadChannels(path, nil)
+	if warn != nil {
+		t.Fatalf("warn = %v", warn)
+	}
+	if len(accounts["qq-obv11"]) != 1 || len(accounts["webhook"]) != 1 {
+		t.Fatalf("non-token platforms should be preserved: %+v", accounts)
+	}
+}
+
+func TestSaveChannelsDropsEmptyTokenBareAccount(t *testing.T) {
+	t.Parallel()
+	path := filepath.Join(t.TempDir(), "channels.json")
+	accts := map[string][]config.ChannelAccount{
+		"kook": {
+			{ID: "", Config: map[string]any{"bot_token": ""}},
+			{ID: "a", Config: map[string]any{"bot_token": "tk"}},
+		},
+		"webhook": {{ID: "", Config: map[string]any{"endpointPath": ""}}},
+	}
+	if err := SaveChannels(path, accts); err != nil {
+		t.Fatalf("save: %v", err)
+	}
+	got, warn := LoadChannels(path, nil)
+	if warn != nil {
+		t.Fatalf("load warn = %v", warn)
+	}
+	if len(got["kook"]) != 1 || got["kook"][0].ID != "a" {
+		t.Fatalf("kook = %+v, want only the token-bearing account", got["kook"])
+	}
+	if _, ok := got["webhook"]; !ok || len(got["webhook"]) != 1 {
+		t.Fatalf("webhook should be preserved untouched: %+v", got["webhook"])
+	}
+}
+
 func TestSaveChannelsRoundTrip(t *testing.T) {
 	t.Parallel()
 	path := filepath.Join(t.TempDir(), "channels.json")