feat(acl): redesign ACL with conversation scope selector (#297)

Backend
- New subject kinds: all / channel_identity / channel_type
- Source scope fields on bot_acl_rules: source_channel,
  source_conversation_type, source_conversation_id, source_thread_id
- Fix source_scope_check constraint: resolve source_channel server-side
  (channel_type → subject_channel_type; channel_identity → DB lookup)
- Add GET /bots/:id/acl/channel-types/:type/conversations to list
  observed conversations by platform type
- ListObservedConversations: include private/DM chats, normalise
  conversation_type; COALESCE(name, handle) for display name
- enrichConversationAvatar: persist entry.Name → conversation_name
  (keeps Telegram group titles current on every message)
- Unify Priority type to int32 across Go types to match DB INTEGER;
  remove all int/int32 casts in service layer
- Fix duplicate nil guard in Evaluate; drop dead SourceScope.Channel field
- Migration 0048_acl_redesign

Frontend
- Drag-and-drop rule priority reordering (SortableJS/useSortable);
  fix reorder: compute new order from oldIndex/newIndex directly,
  not from the array (which useSortable syncs after onEnd)
- Conversation scope selector: searchable popover backed by observed
  conversations (by identity or platform type); collapsible manual-ID fallback
- Display: name as primary label, stable channel·type·id always shown
  as subtitle for verification
- bot-terminal: accessibility fix on close-tab button (keyboard events)
- i18n: drag-to-reorder, conversation source, manual IDs (en/zh)

Tests: update fakeChatACL to Evaluate interface; fix SourceScope literals.
SDK/spec regenerated.

internal/command/settings.go

@@ -21,7 +21,7 @@ func (h *Handler) buildSettingsGroup() *CommandGroup {
 			}
 			return formatKV([]kv{
 				{"Language", s.Language},
-				{"Allow Guest", boolStr(s.AllowGuest)},
+				{"ACL Default Effect", s.AclDefaultEffect},
 				{"Max Context Load Time", fmt.Sprintf("%d min", s.MaxContextLoadTime)},
 				{"Max Context Tokens", strconv.Itoa(s.MaxContextTokens)},
 				{"Reasoning Enabled", boolStr(s.ReasoningEnabled)},
@@ -38,7 +38,7 @@ func (h *Handler) buildSettingsGroup() *CommandGroup {
 	})
 	g.Register(SubCommand{
 		Name:    "update",
-		Usage:   "update [--language L] [--allow_guest true|false] ... - Update settings",
+		Usage:   "update [--language L] [--acl_default_effect allow|deny] ... - Update settings",
 		IsWrite: true,
 		Handler: func(cc CommandContext) (string, error) {
 			if len(cc.Args) == 0 {
@@ -54,10 +54,9 @@ func (h *Handler) buildSettingsGroup() *CommandGroup {
 				case "--language":
 					i++
 					req.Language = args[i]
-				case "--allow_guest":
+				case "--acl_default_effect":
 					i++
-					v := strings.ToLower(args[i]) == "true"
-					req.AllowGuest = &v
+					req.AclDefaultEffect = args[i]
 				case "--reasoning_enabled":
 					i++
 					v := strings.ToLower(args[i]) == "true"
@@ -114,7 +113,7 @@ func settingsUpdateUsage() string {
 	return "Usage: /settings update [options]\n\n" +
 		"Options:\n" +
 		"- --language <value>\n" +
-		"- --allow_guest <true|false>\n" +
+		"- --acl_default_effect <allow|deny>\n" +
 		"- --reasoning_enabled <true|false>\n" +
 		"- --reasoning_effort <low|medium|high>\n" +
 		"- --heartbeat_enabled <true|false>\n" +