feat(weixin-ilink,gateway): 会话过期显式化 — 不再静默变哑/假 OK 重连，面板可见「需重扫」

- 适配器新增过期状态机(plugins/channels/weixin_ilink/session_state.go)：getupdates/sendmessage/getuploadurl 收到 errcode=-14 即 markExpired（ERROR 仅一次，只带 bot_id，token 永不入日志），扫码登录拿到新 token 或配置换新 token 时清除（惰性比对）
- Connect/HealthCheck 在过期时返回 ErrSessionExpired（可与 ErrNotConnected 区分）：不再对死 token 设 connected=true 报假成功；发送路径同样返回该错误而不是笼统 ErrNotConnected
- 网关：POST /admin/channels/open 遇过期 → 409 session_expired + 明确文案（不再吞错回 200）；GET /admin/channels 摘要新增 needsRescan/lastError（经可选接口类型断言读取，取不到不伪造）
- channelbridge：读循环非取消退出时把自身记账的 connected 置 false（热重载被替换者退出不抹掉新实例）
- login/login_admin：过期时 StartLogin 允许重新出码、LoginStatus 如实报 failed（原先可能把死 token 当 confirmed 重新落盘）
- Docs/api-client v0.39；新增 5 组测试 + 变异验证（去掉标记/恢复假成功/网关不填字段 均 FAIL）

internal/services/gateway/admin_write_llm_channels.go

@@ -236,6 +236,15 @@ func (s *Server) adminChannelOpen(w http.ResponseWriter, r *http.Request) {
 	}
 	if err := ch.Connect(r.Context()); err != nil {
 		s.auditClaims(r, "channel.open", "error")
+		// A state a plain reconnect cannot fix must not read as a generic failure:
+		// the weixin-iLink bot token was rejected by iLink (errcode=-14), so the
+		// owner needs a fresh scan-code login. Answer 409 with that instruction
+		// instead of pretending the channel opened (the panel marks it connected).
+		if errors.Is(err, weixin_ilink.ErrSessionExpired) {
+			writeError(w, apperr.Wrap(apperr.ErrConflict, "session_expired",
+				"该渠道会话已过期（需要重新扫码登录）：请用「扫码登录」重新绑定后再连接"))
+			return
+		}
 		// weixin-iLink with no token yet must not hang nor read as a credential
 		// error: the panel routes the owner to the out-of-band 扫码登录 flow.
 		if errors.Is(err, weixin_ilink.ErrNeedsLogin) {