feat: support Feishu conversation labels

[ArchLance]

Summary

• add native Feishu conversation-label listing, creation, and chat assignment
• expose label selection in Dashboard group/session creation, including optional new-label creation
• add user OAuth with automatic local loopback callback and remote-VM paste fallback
• persist OAuth pending state across Dashboard and daemon processes
• add required Feishu scopes and legacy-app permission top-up

Verification

• pnpm exec vitest run --project unit test/dashboard-feed-groups.test.ts test/user-token-cross-process.test.ts test/setup-verify-permissions.test.ts
• pnpm build
• manually verified Dashboard authorization and existing/new label flows on a remote Devbox deployment

[ArchLance]

Addressed both review findings in b56c740:

• P1: removed im:feed_group_v1:{read,write} from generic DEFAULT_SCOPES; Dashboard continues to request them explicitly through extraScopes.
• Added regression coverage proving generic Feishu/Lark login URLs exclude feed-group scopes and explicit Dashboard-style requests include them.
• P2: wrapped loadBotConfigs() and label assignment in both create paths so configuration read failures degrade to feedGroupError; already-created groups are still returned and session spawning continues.

Verification:

• 34 focused unit tests passed.
• pnpm build passed.

[github-actions]

🚀 Released in v3.11.0