fix: auto-allow the group created by /new chat

[loml13]

Motivation

/new chat spins up a fresh Feishu/Lark group, invites the requester, inherits
the cwd, and posts a welcome message — but the new chat_id is never added to
preferences.access.allowedChats.

The v2 access policy is fail-closed: canUseGroup only lets a group
through when the sender is the owner/an admin, or the chat_id is in
allowedChats. So for anyone who isn't the owner/admin, the bot won't engage
in the very group it just created (skip-not-allowed-user, reason
denied-chat) — at best it replies with a "group not allowed" hint telling
you to run /invite group, at worst (non-mention messages) it just drops
them. Either way, it builds a room it then refuses to actually use. The only
recovery today is to run /invite group from inside the new group.

Repro

1. Ensure the requesting user is a non-owner allowed user (allowedUsers, not
   admins).
2. Send /new chat demo.
3. The bot creates the group and posts the welcome message.
4. Send any message in the new group.
5. The bot won't actually chat there — log event: skip-not-allowed-user
   (reason denied-chat) — because the new chat_id was never whitelisted.

Change

After the group is created (and the cwd inherited), persist the new chat_id
into allowedChats, reusing the existing saveAccessConfig path so the write
goes through the same config-file lock and in-memory refresh as /invite. The
add is idempotent (set-based) and best-effort: the group already exists, so
a persistence failure only logs a warning and leaves /invite group as the
manual fallback rather than failing the command. The log line records only the
last 6 chars of the chat_id.

Compatibility

No behavior change to any existing flow. This only writes a chat_id the bot
just created into the allowlist — exactly what the user would otherwise have to
do by hand with /invite group. Existing groups and access lists are
untouched.

Testing

• pnpm typecheck — clean.
• pnpm test — full suite green (adds 2 tests).
• New tests/integration/commands/new-chat-auto-allow.test.ts:
  • /new chat persists the created chat_id into allowedChats.
  • Idempotent when the chat_id is already allowed (no duplicate entry).

🤖 Generated with Claude Code