fix: Web Widget SDK + Auto-Reply AgentBot sender + LLM 真实模型对接

## 核心修复

### 1. Auto-Reply Sender 修复（所有渠道）
- AutoReplyListener.sendAutoReply() 通过 botInboxRepo 查询 inbox 关联的 AgentBot
- 使用正确的 SenderType="AgentBot"（非小写 agent_bot）传递真实 AgentBot ID
- bootstrap 注入 agentBotInboxRepo/agentBotRepo 依赖

### 2. 事件数据 BUG 修复（影响所有 Webhook 渠道）
- incoming_persister.dispatch(): 补全 sender_type/content 到 event.Data
- channel/webhook.go: HandleWebhook 同步分发也补全 sender_type/content
- 未补全前 AutoReplyListener 找不到字段直接跳过

### 3. Web Widget SDK 生产验证修复
- cookie → localStorage token 同步（frontend/index.html）
- 路由双注册修复（router.go）
- Vite SPA 模式 + /widget 重写（vite.config.ts）
- WidgetService 注入 Dispatcher 触发事件分发

### 4. LLM 真实模型对接
- 配置 deepseek-v4-flash @ http://10.58.144.6:2014/v1
- LLM-mode auto-reply 规则创建并验证通过
- Prompt 文档落地: docs/captain-ai-auto-replay-prompt.md

### 5. 新增基础设施
- Helm chart (deploy/helm/)
- Widget SDK 生产测试页面
- QA 报告

Closes: BUG-W2 (auth sync), BUG-W3 (route double-reg),
       BUG-WEBHOOK-EVENT (missing event data fields)

frontend/index.html

@@ -49,6 +49,32 @@
         );
         window.errorLoggingConfig = '';
         window.browserConfig = { browser_name: navigator.userAgent };
+        
+        // BUG-11 mitigation: sync auth tokens from cookie to localStorage on page load
+        // The backend stores tokens in cw_d_session_info cookie, but the Vue SPA's
+        // axios interceptor reads from localStorage. This bridge ensures the tokens
+        // are available in both stores.
+        (function() {
+          try {
+            var cookies = document.cookie.split('; ');
+            var sessionCookie = cookies.find(function(c) { return c.startsWith('cw_d_session_info='); });
+            if (sessionCookie) {
+              var raw = decodeURIComponent(sessionCookie.split('=').slice(1).join('='));
+              var extract = function(key) {
+                var match = raw.match(new RegExp('"' + key + '":"([^"]+)"'));
+                return match ? match[1] : '';
+              };
+              var token = extract('access-token');
+              if (token) {
+                localStorage.setItem('access-token', token);
+                localStorage.setItem('client', extract('client'));
+                localStorage.setItem('uid', extract('uid'));
+                localStorage.setItem('token-type', extract('token-type') || 'Bearer');
+                localStorage.setItem('expiry', extract('expiry'));
+              }
+            }
+          } catch(e) { /* ignore cookie parse errors */ }
+        })();
       })();
     </script>
   </head>