feat(dsh): adapt to DSH 0.1.5 via the official SDK runtime; add QQ commands and bot interop - #4

…mmands and bot interop

DSH 0.1.5-rc.1 replaced the host-apiproxy HTTP/WS transport this bridge was built
on: /api gained a browser-session auth fence, the dot-named RPC endpoints are gone,
and the shipped 0.1.1-rc.2 apiproxy cannot even be loaded against 0.1.5 (it imports
ApiRemoteSessionNotFound, which no longer exists). This moves the bridge onto the
official SDK surface instead.

DSH transport
- new src/dsh-sdk-client.js: spawns `dsh --profile sdk` as a child process and speaks
  the documented newline-delimited JSON-RPC protocol over stdio (initialize /
  session/prompt / shutdown + session.event notifications)
- an adapter reshapes that transport back into the api.* surface bridge.js already
  used, so only two lines changed outside the adapter
- the SDK runtime cannot resume an existing session, and reusing an id already
  present in DSH's shared session store fails with `session "..." already exists`;
  the bridge now drops stale mappings on boot and allocates fresh run-scoped ids
- adapter return shapes are pinned by scripts/test-adapter-contract.mjs (a silent
  shape mismatch is what broke the first attempt)
- config: dsh.provider/model -> deepseek-official/deepseek-flash (the sdk profile
  only mounts built-in adapters), plus dsh.sdkProfile
- the SDK profile needs ~/.dsh/profiles/sdk/cordis.patch.yml with
  agent-presets default=qq-chat-v2 and the three qq MCP servers

QQ commands (answered locally, no model tokens)
- new src/qq-commands.js + a router in bridge.js: /指令 /状态 /ping /机器人 /我是谁
  for everyone; /潜水 /唤醒 /暂停 /继续 /重置 /模型 /角色 /静默 /活跃 /调机器人
  for the owner
- unknown "/xxx" no longer gets a blanket "admin only" reply: the owner's is
  forwarded to DSH, everyone else's continues as ordinary chat
- rate limiting is per conversation+sender so one person cannot starve others

Bot interop
- new src/bot-registry.js: SnowLuma returns is_robot in the group member list
  (message events carry no bot flag), so the bridge caches a per-group robot roster
  (state/bots.json) with a nickname heuristic as fallback
- other bots' messages are tagged isBot and marked in the sender label; the wake
  prompt lists the group's robots
- qq_list_group_bots / qq_call_bot let the agent invoke another bot's commands

Quote replies
- qq_reply and qq_send_group_message take an optional atUserId
- qq_send_burst now accepts replyToMessageId + atUserId (first message only)
- responses carry the resolved quoted sender

Tests: 16 command-parser assertions, 13 bot-registry assertions, and a 23-check
end-to-end suite that drives a real bridge against a fake OneBot gateway.