fix: harden fake channel — production guard, token validation, typing events, URL validation, capability narrowing

- Guard fake channel with GOCHAT_ENV check: skip init() registration,
  bootstrap wiring, and inbox creation in production
- Reject empty-token webhooks in production (was silently skipped)
- Use PostgreSQL jsonb @> query for inbox lookup, keep SQLite fallback
- Replace isValidURL string-prefix hack with net/url.Parse
- Handle typing.start/typing.stop by returning nil (no garbage messages)
- Narrow Capabilities to only implemented features (Attachments, Replies)
- Hide fake channel from frontend channel list in production builds

backend/internal/service/inbox_service.go

@@ -173,7 +173,7 @@ func (s *InboxService) Create(ctx context.Context, accountID uint, req CreateInb
 		"web_widget": true, "telegram": true, "facebook": true,
 		"instagram": true, "whatsapp": true, "email": true, "api": true,
 		"tiktok": true, "line": true, "twilio_sms": true, "sms": true,
-		"fake": true,
+		"fake": isFakeChannelAllowed(),
 	}
 	if !validChannelTypes[req.ChannelType] {
 		return nil, errors.New("invalid channel_type")
@@ -2125,3 +2125,15 @@ func generateRandomHex(n int) (string, error) {
 	}
 	return hex.EncodeToString(b), nil
 }
+
+// isFakeChannelAllowed reports whether the fake test channel is allowed.
+// It is disabled in production environments.
+func isFakeChannelAllowed() bool {
+	env := strings.ToLower(strings.TrimSpace(os.Getenv("GOCHAT_ENV")))
+	switch env {
+	case "production", "prod":
+		return false
+	default:
+		return true
+	}
+}