fix: KOOK 连不上根因——空token裸账号不注册/占名 + open指向带token账号 + 前端token不覆盖真值

agent-119 后端:
- buildAccountAdapter: token平台(kook/telegram/weixin)BotToken空→跳过build(不注册不占名), channelAccountsFromEnv 无tokenenv不合成账号(杜绝裸kook id="")
- runtimeconfig cleanAccounts: LoadChannels/SaveChannels 丢弃token平台空token账号(清理channels.json现有裸kook, 下次保存抹掉)
- findChannel: 裸平台名(kook)回退到该平台第一个带token账号, open"kook"不再命中裸的missing token

我补 前端token掩码不就覆真值:
- openConfig 不再把'（已配置，仅掩码显示）'当token回填(setToken空)→save token空不写bot_token保留真值
- 加 tokenHint(显示'已配置留空不改'/重填换); 修之前channels.json kook:3fc8 token变掩码串的bug
全仓 build/vet/test绿+前端build绿(463行)

internal/services/gateway/admin_write_llm_channels.go

@@ -283,15 +283,30 @@ func (s *Server) channelName(r *http.Request, w http.ResponseWriter, op string)
 	return req.Name, true
 }
 
-// findChannel returns the registered channel adapter named name, if any.
+// findChannel returns the registered channel adapter named name, if any. An exact
+// adapter name ("kook:conf0") wins; a bare platform name ("kook") that is not an
+// exact name still resolves to that platform's first registered account, so the
+// panel/CLI "connect kook" reaches the token-bearing account even when it is named
+// "kook:conf0" (the empty-token bare placeholder is never registered).
 func findChannel(caps CapabilityStore, name string) (sdk.Channel, bool) {
 	if caps == nil {
 		return nil, false
 	}
+	var first sdk.Channel
 	for _, cap := range caps.List(capreg.KindChannel) {
-		if ch, ok := cap.Value.(sdk.Channel); ok && ch.Name() == name {
+		ch, ok := cap.Value.(sdk.Channel)
+		if !ok {
+			continue
+		}
+		if ch.Name() == name {
 			return ch, true
 		}
+		if first == nil && channelBasePlatform(ch.Name()) == name {
+			first = ch
+		}
+	}
+	if first != nil {
+		return first, true
 	}
 	return nil, false
 }