feat(hub): 真实飞书读取 + 状态卡片 + 权限 gate + 部署脚本

FeishuRead(ADR-0003): feishuContextTool 从 stub 换成真实 lark
  im.v1.message.get(单条 trigger/reply/status_card)+ list(thread 回复);
  ADR-0003 chat 授权不变式不变(handler 已 gate)。
StatusCard: sendCard + buildRunStatusCard——完成/出错发 interactive card
  (status 文案 + model 选择器 + 取消按钮带 runId),替代纯文本。
Permission(ADR-0004, project-wise): triggerAgent 查 PermissionGrant 对
  project 的 edit+ 能力(manage⊇edit 单调);sender open_id 当 principal
  (子类型学 OPEN,务实选择,permission.ts 标注);per-artifact OPEN;
  settings 组合规则 OPEN。无权限回 '无权限触发'。
Deploy: cph-hub.service systemd unit(ExecStartPre 跑 prisma migrate)+
  install_service.sh(idempotent,seed env)+ deploy_platform.sh
  (rsync + npm ci + build + restart + healthz)。
client.ts 抽 createLarkClient/startFeishuListenerWithClient,tools 与
  ws 共用同一 client。
tsc rc=0;prisma validate 通过;deploy 脚本 bash -n 通过。

hub/src/feishu/client.ts

@@ -61,31 +61,96 @@ export async function sendText(rt: FeishuRuntime, chatId: string, text: string):
   });
 }
 
+/** Send an interactive card to a chat. `card` is the lark card schema object. */
+export async function sendCard(
+  rt: FeishuRuntime,
+  chatId: string,
+  card: unknown,
+): Promise<string | null> {
+  const client = rt.client as unknown as {
+    im: { v1: { message: { create: (p: unknown) => Promise<{ data?: { message_id?: string } }> } } };
+  };
+  const res = await client.im.v1.message.create({
+    params: { receive_id_type: "chat_id" },
+    data: {
+      receive_id: chatId,
+      msg_type: "interactive",
+      content: JSON.stringify(card),
+    },
+  });
+  return res.data?.message_id ?? null;
+}
+
+/** Build a run-status card: status text + model selector + cancel button. */
+export function buildRunStatusCard(opts: {
+  readonly status: string;
+  readonly model: string;
+  readonly models: readonly { readonly id: string; readonly label: string }[];
+  readonly runId: string;
+}): unknown {
+  return {
+    config: { wide_screen_mode: true },
+    header: {
+      title: { tag: "plain_text", content: `@Claude · ${opts.status}` },
+      template: opts.status === "处理完成" ? "green" : opts.status === "处理出错" ? "red" : "blue",
+    },
+    elements: [
+      { tag: "div", text: { tag: "lark_md", content: `**model:** ${opts.model}` } },
+      {
+        tag: "action",
+        actions: [
+          {
+            tag: "select",
+            placeholder: { tag: "plain_text", content: "切换 model" },
+            options: opts.models.map((m) => ({ text: { tag: "plain_text", content: m.label }, value: m.id })),
+            value: opts.model,
+          },
+          {
+            tag: "button",
+            text: { tag: "plain_text", content: "取消" },
+            type: "danger",
+            value: JSON.stringify({ action: "cancel", runId: opts.runId }),
+          },
+        ],
+      },
+    ],
+  };
+}
+
 /**
  * Start the lark WebSocket client and route `im.message.receive_v1` events to
  * `onMessage`. The ws connection lives in the background; this resolves the
  * runtime handle.
  */
-export function startFeishuListener(
-  config: FeishuConfig,
-  logger: FastifyBaseLogger,
-  onMessage: (event: MessageReceiveEvent, rt: FeishuRuntime) => Promise<void>,
-): FeishuRuntime {
-  const client = new lark.Client({
+/** Build a lark Client (HTTP API surface). Used before the ws starts, so tools
+ * that need to call Feishu APIs can hold it from server boot. */
+export function createLarkClient(config: FeishuConfig): lark.Client {
+  return new lark.Client({
     appId: config.appId,
     appSecret: config.appSecret,
     appType: lark.AppType.SelfBuild,
   });
+}
 
+export interface FeishuListener {
+  readonly runtime: FeishuRuntime;
+  readonly stop: () => Promise<void>;
+}
+
+/** Start the ws listener using an already-built client. Returns the runtime. */
+export function startFeishuListenerWithClient(
+  config: FeishuConfig,
+  client: lark.Client,
+  logger: FastifyBaseLogger,
+  onMessage: (event: MessageReceiveEvent, rt: FeishuRuntime) => Promise<void>,
+): FeishuRuntime {
   const wsClient = new lark.WSClient({
     appId: config.appId,
     appSecret: config.appSecret,
     domain: lark.Domain.Feishu,
     loggerLevel: lark.LoggerLevel.info,
   });
-
   const rt: FeishuRuntime = { client, logger };
-
   void wsClient.start({
     eventDispatcher: new lark.EventDispatcher({}).register({
       "im.message.receive_v1": async (data) => {
@@ -97,6 +162,12 @@ export function startFeishuListener(
       },
     }),
   });
-
   return rt;
 }
+export function startFeishuListener(
+  config: FeishuConfig,
+  logger: FastifyBaseLogger,
+  onMessage: (event: MessageReceiveEvent, rt: FeishuRuntime) => Promise<void>,
+): FeishuRuntime {
+  return startFeishuListenerWithClient(config, createLarkClient(config), logger, onMessage);
+}