fix: harden fake channel — production guard, token validation, typing events, URL validation, capability narrowing

- Guard fake channel with GOCHAT_ENV check: skip init() registration,
  bootstrap wiring, and inbox creation in production
- Reject empty-token webhooks in production (was silently skipped)
- Use PostgreSQL jsonb @> query for inbox lookup, keep SQLite fallback
- Replace isValidURL string-prefix hack with net/url.Parse
- Handle typing.start/typing.stop by returning nil (no garbage messages)
- Narrow Capabilities to only implemented features (Attachments, Replies)
- Hide fake channel from frontend channel list in production builds

frontend/app/javascript/dashboard/routes/dashboard/settings/inbox/ChannelList.vue

@@ -77,13 +77,17 @@ const channelList = computed(() => {
       description: t('INBOX_MGMT.ADD.AUTH.CHANNEL.INSTAGRAM.DESCRIPTION'),
       icon: 'i-woot-instagram',
     },
-    {
+  ];
+
+  // Fake channel is a test-only tool — show only in development builds.
+  if (import.meta.env.DEV) {
+    channels.push({
       key: 'fake',
       title: t('INBOX_MGMT.ADD.AUTH.CHANNEL.FAKE.TITLE'),
       description: t('INBOX_MGMT.ADD.AUTH.CHANNEL.FAKE.DESCRIPTION'),
       icon: 'i-woot-api',
-    },
-  ];
+    });
+  }
 
   if (hasTiktokConfigured.value) {
     channels.push({