fix: KOOK 连不上根因——空token裸账号不注册/占名 + open指向带token账号 + 前端token不覆盖真值

agent-119 后端:
- buildAccountAdapter: token平台(kook/telegram/weixin)BotToken空→跳过build(不注册不占名), channelAccountsFromEnv 无tokenenv不合成账号(杜绝裸kook id="")
- runtimeconfig cleanAccounts: LoadChannels/SaveChannels 丢弃token平台空token账号(清理channels.json现有裸kook, 下次保存抹掉)
- findChannel: 裸平台名(kook)回退到该平台第一个带token账号, open"kook"不再命中裸的missing token

我补 前端token掩码不就覆真值:
- openConfig 不再把'（已配置，仅掩码显示）'当token回填(setToken空)→save token空不写bot_token保留真值
- 加 tokenHint(显示'已配置留空不改'/重填换); 修之前channels.json kook:3fc8 token变掩码串的bug
全仓 build/vet/test绿+前端build绿(463行)

internal/services/gateway/admin_write_llm_channels.go

@@ -283,15 +283,30 @@ func (s *Server) channelName(r *http.Request, w http.ResponseWriter, op string)
 	return req.Name, true
 }
 
-// findChannel returns the registered channel adapter named name, if any.
+// findChannel returns the registered channel adapter named name, if any. An exact
+// adapter name ("kook:conf0") wins; a bare platform name ("kook") that is not an
+// exact name still resolves to that platform's first registered account, so the
+// panel/CLI "connect kook" reaches the token-bearing account even when it is named
+// "kook:conf0" (the empty-token bare placeholder is never registered).
 func findChannel(caps CapabilityStore, name string) (sdk.Channel, bool) {
 	if caps == nil {
 		return nil, false
 	}
+	var first sdk.Channel
 	for _, cap := range caps.List(capreg.KindChannel) {
-		if ch, ok := cap.Value.(sdk.Channel); ok && ch.Name() == name {
+		ch, ok := cap.Value.(sdk.Channel)
+		if !ok {
+			continue
+		}
+		if ch.Name() == name {
 			return ch, true
 		}
+		if first == nil && channelBasePlatform(ch.Name()) == name {
+			first = ch
+		}
+	}
+	if first != nil {
+		return first, true
 	}
 	return nil, false
 }

internal/services/gateway/findchannel_test.go

@@ -0,0 +1,64 @@
+package gateway
+
+import (
+	"context"
+	"testing"
+
+	capreg "git.yeij.top/AskaEth/Cyrene_v2/internal/capability/registry"
+)
+
+// testChannel is a bare sdk.Channel used to exercise findChannel resolution.
+type testChannel struct{ name string }
+
+func (t testChannel) Name() string { return t.name }
+func (t testChannel) Connect(context.Context) error {
+	return nil
+}
+func (t testChannel) Disconnect(context.Context) error { return nil }
+func (t testChannel) IsConnected() bool                 { return false }
+func (t testChannel) HealthCheck(context.Context) error { return nil }
+
+// TestFindChannelExactMatch prefers an exact adapter name over a bare-name match.
+func TestFindChannelExactMatch(t *testing.T) {
+	reg := capreg.New()
+	_ = reg.Register(capreg.Capability{Name: "kook:conf0", Kind: capreg.KindChannel, Value: testChannel{name: "kook:conf0"}})
+	_ = reg.Register(capreg.Capability{Name: "telegram:conf0", Kind: capreg.KindChannel, Value: testChannel{name: "telegram:conf0"}})
+	ch, ok := findChannel(reg, "kook:conf0")
+	if !ok || ch.Name() != "kook:conf0" {
+		t.Fatalf("exact kook:conf0 not found, got %v/%v", ch, ok)
+	}
+	ch, ok = findChannel(reg, "telegram:conf0")
+	if !ok || ch.Name() != "telegram:conf0" {
+		t.Fatalf("exact telegram:conf0 not found, got %v/%v", ch, ok)
+	}
+}
+
+// TestFindChannelBarePlatformResolvesToTokenAccount verifies a bare platform name
+// ("kook") that is not an exact adapter name resolves to that platform's first
+// registered account (the token-bearing one, since the empty-token bare account
+// is never registered).
+func TestFindChannelBarePlatformResolvesToTokenAccount(t *testing.T) {
+	reg := capreg.New()
+	_ = reg.Register(capreg.Capability{Name: "kook:3fc8", Kind: capreg.KindChannel, Value: testChannel{name: "kook:3fc8"}})
+	ch, ok := findChannel(reg, "kook")
+	if !ok || ch.Name() != "kook:3fc8" {
+		t.Fatalf("bare kook should resolve to kook:3fc8, got %v/%v", ch, ok)
+	}
+}
+
+// TestFindChannelUnknownOrBlank rejects a name that matches no channel.
+func TestFindChannelUnknownOrBlank(t *testing.T) {
+	reg := capreg.New()
+	_ = reg.Register(capreg.Capability{Name: "kook:conf0", Kind: capreg.KindChannel, Value: testChannel{name: "kook:conf0"}})
+	if _, ok := findChannel(reg, "unknown"); ok {
+		t.Fatal("unknown name should not be found")
+	}
+	if _, ok := findChannel(reg, ""); ok {
+		t.Fatal("blank name should not be found")
+	}
+	// Skipped: non-channel capabilities must not match.
+	_ = reg.Register(capreg.Capability{Name: "some-tool", Kind: capreg.KindTool, Value: testChannel{name: "some-tool"}})
+	if _, ok := findChannel(reg, "some-tool"); ok {
+		t.Fatal("non-channel capability must not match findChannel")
+	}
+}