feat(weixin): 微信iLink扫码登录——面板触发+二维码显示+状态轮询+确认热连接

适配器: login_admin.go(StartLogin 幂等取二维码/LoginStatus idle-waiting-confirmed-failed);
       login.go 重写 Connect 委托 StartLogin+等待,后台 runLogin 轮询,completeLogin/failLogin
       (锁序 loginMu->a.mu 不嵌套反向无死锁); adapter.go 加登录会话字段
网关: admin_channels_weixin.go(2 端点 login-qr/login-status owner+审计, confirmed 合并写回
       channels.json 保留 base_url/cdn/黑白名单 + Reload 热重载连接; qrImage best-effort Base64,
       token 掩码) + server.go 路由
前端: WeixinLogin.tsx(token空→扫码按钮→二维码→1.5s轮询→confirmed提示已登录+显示bot_id),
       AdapterDetailPage 渲染, api/types 补类型
必需偏离(最小化): 允许空token的weixin账号被构建/持久化(channels.go+runtimeconfig移出
       tokenRequiringPlatforms),否则空token账号无法注册调用StartLogin; 空token保持断开(configured
       仍要求token非空),确认后才持久化连接——守红线。
测试: login_admin/admin端点用例; 后端 build/vet/test 全绿 + 前端 build 101模块绿.

internal/config/runtimeconfig/channels.go

@@ -217,9 +217,16 @@ func maskToken(s string) string {
 // channels.json. Other platforms (qq-obv11, webhook) are left alone so their
 // channel list stays stable while the bridge's configured() gate decides whether
 // to dial.
+//
+// weixin-ilink is deliberately NOT token-required here: an empty-token account is
+// a legitimate pending scan-login (design/08 §4). The panel saves a bare weixin
+// account, drives get_bot_qrcode/get_qrcode_status via the admin login endpoints,
+// and the bridge's configured() gate keeps it disconnected until the scan
+// confirms and the token is persisted — so such an account must survive loading
+// and writing, not be dropped as a placeholder.
 func tokenRequiringPlatforms(platform string) bool {
 	switch platform {
-	case "kook", "telegram", "weixin-ilink":
+	case "kook", "telegram":
 		return true
 	default:
 		return false