security: harden architecture against Moltbot security model

- Discord: add allowed_users field + sender validation in listen()
- Slack: add allowed_users field + sender validation in listen()
- Webhook: add X-Webhook-Secret header auth (401 on mismatch)
- SecurityPolicy: add ActionTracker with sliding-window rate limiting
  - record_action() enforces max_actions_per_hour
  - is_rate_limited() checks without recording
- Gateway: print auth status on startup (ENABLED/DISABLED)
- 22 new tests (Discord/Slack allowlists, gateway header extraction,
  rate limiter: starts at zero, records, allows within limit,
  blocks over limit, clone independence)
- 554 tests passing, 0 clippy warnings

src/channels/mod.rs

@@ -250,6 +250,7 @@ pub async fn start_channels(config: Config) -> Result<()> {
         channels.push(Arc::new(DiscordChannel::new(
             dc.bot_token.clone(),
             dc.guild_id.clone(),
+            dc.allowed_users.clone(),
         )));
     }
 
@@ -257,6 +258,7 @@ pub async fn start_channels(config: Config) -> Result<()> {
         channels.push(Arc::new(SlackChannel::new(
             sl.bot_token.clone(),
             sl.channel_id.clone(),
+            sl.allowed_users.clone(),
         )));
     }