feat(wecom): full [wecom] section — credentials + connection config-first

[chaodu-agent]

Summary

Extend [wecom] beyond the trust fields (#1366): graduate from the shared PlatformTrustConfig to a dedicated WecomConfig covering credentials + connection. Config-first invariant: [wecom] → WECOM_* env → default.

Fields to add

corp_id, secret, token, encoding_aes_key, agent_id, webhook_path, streaming_enabled, debounce_secs (env fallbacks: WECOM_*)

Tasks

• Dedicated WecomConfig + resolve; keep existing trust fields
• Bridge + AppState::apply_wecom_config() (adapter's from_reader pattern helps testing)
• docs/wecom.md + config-reference.md
• Regression: env-only unchanged; config wins per-field

Refs

Umbrella: #1375 · Trust slice: #1366 · Reference: TelegramConfig (#1297)

[github-actions]

⚠️ This issue is missing the following required information and will not be processed until completed:

• Use Case

Please edit this issue to fill in the missing fields. Thank you!

Tip: Use headings like ## Description or ### Description — common synonyms (e.g. ## Problem, ## Reproduction, ## Motivation) are also accepted.