chore(sync): merge upstream main back into dev

[JOY (JOY)]

Summary

Periodic sync after upstream merged huabeitech#51 (the Slack deployment-wide credentials + webhook hardening port, originally authored here) and huabeitech#52 (community docs PR - English screenshots).

Conflict resolution notes:

• the fork's Slack implementation and the upstream feat(slack): deployment-wide Slack app credentials and webhook hardening huabeitech/agent-desk#51 port descend from the same source, so conflicts were drift-level; the fork side keeps its hardened variants (fail-closed verification token check, secret-source warn logs, replay-window tests)
• union kept BOTH deployment-fallback tests (the upstream-port's TestSlackInboundFallsBackToDeploymentSigningSecret and the fork's TestVerifySlackSignatureEnforcesReplayWindow drift table)
• firstNonBlank and the config resolver suite deduped; env example kept the fork's fuller Meta/Slack documentation blocks

No upstream file or test dropped (verified post-commit). DB_TYPE stays out of prod .env per the 2026-09-25 sqlite incident.

Validation

Full Go suite green with go test -tags dev across the CI package list; vet clean; frontend typecheck clean.

---

📌 TL;DR

This PR implements a fallback mechanism for Slack webhook signature verification, allowing channels without a specific signing secret to use the deployment-wide configuration. It also includes minor import and whitespace cleanups in related Slack service files.

🎯 Type of Change

• 🚀 New feature
• 🐛 Bugfix
• 🧹 Refactor
• ⚡ Performance
• 📚 Documentation
• ⚙️ CI / Configuration

🔍 Changes Walkthrough

File	Summary of Changes
internal/services/slack_inbound_service.go	Reorganized imports to group standard library, internal models, and internal packages logically.
internal/services/slack_inbound_service_test.go	Added a new test case TestSlackInboundFallsBackToDeploymentSigningSecret to verify that webhooks signed with the global deployment secret are accepted when a channel lacks a specific secret.
internal/services/slack_outbound_service.go	Removed unnecessary blank lines in imports and within the processOutbox function for code cleanliness.

📊 Architectural Flow

sequenceDiagram
    participant Slack as Slack Platform
    participant Service as SlackInboundService
    participant Channel as Channel Model
    participant Config as Global Config

    Slack->>Service: Webhook Request (Timestamp, Signature, Payload)
    Service->>Channel: Get Channel by ID
    alt Channel has specific SigningSecret
        Service->>Service: Verify Signature using Channel Secret
    else Channel SigningSecret is empty
        Service->>Config: Get Deployment-wide SigningSecret
        Service->>Service: Verify Signature using Deployment Secret
    end
    Service->>Service: Process Event if Valid

Loading

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 3e925da8-e040-4927-bcb9-a973351aa70d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates screenshot asset paths in the README, cleans up imports and whitespace in the Slack services, and adds a new test to verify that Slack inbound channels fall back to the deployment-wide signing secret. The feedback recommends capturing and restoring the existing global configuration in the test's defer block rather than setting it to nil, preventing potential side effects on other tests.

[gemini-code-assist]

Unconditionally setting the global configuration to nil in defer can break other tests in the same package if they run sequentially and rely on a previously initialized configuration. It is safer to capture the existing configuration and restore it when the test finishes.

Suggested change

	config.SetCurrent(&config.Config{Slack: config.SlackConfig{SigningSecret: slackTestSigningSecret}})
	defer config.SetCurrent(nil)
	oldConfig := config.GetCurrent()
	config.SetCurrent(&config.Config{Slack: config.SlackConfig{SigningSecret: slackTestSigningSecret}})
	defer config.SetCurrent(oldConfig)