feat: extend Feishu service with Approval and Contact APIs

[xiaoss]

Summary

• keep the existing Feishu_GroupRobot.Feishu_GroupRobot/SendTextMessage contract and extend the same Service with Feishu Approval and Contact APIs
• add tenant access-token management, approval definition/instance reads, approval create/cancel, approval Bot template 1021 delivery, and user/department lookups
• expose every operation as an explicit protobuf RPC so deployments can select notification, approval read/write, approval Bot, and contact methods independently through capsets
• validate Feishu business responses, sanitize upstream failures, and avoid automatic retries for ambiguous mutations
• document configuration, credentials, permissions, rate limits, idempotency, and known boundaries

Compatibility and security

• existing webhook-only Instances and the legacy text-message RPC remain supported
• appId, appSecret, tenant tokens, and webhook tokens are never returned or logged
• Open Platform mutations are not automatically retried; create and approval Bot calls require caller-provided Feishu UUIDs
• successful HTTP responses carrying Feishu business errors now map to explicit gRPC errors instead of false successes
• inbound event subscription, callback verification/decryption, event deduplication, rich cards, and arbitrary message types are intentionally out of scope

Source and license declaration

This is an original JavaScript implementation based only on Feishu's public Open Platform documentation:

• Group bot messages
• Tenant access token
• Approval v4
• Approval Bot messages
• Contact v3

It does not contain vendor code, private SDKs, reverse-engineered interfaces, captured traffic, customer data, or real credentials. It uses no third-party Feishu SDK and adds no dependency beyond the repository's existing @chaitin-ai/octobus-sdk and undici dependencies. Users provide their own authorized application credentials and webhook, grant the required scopes/contact data range, and remain subject to Feishu rate limits and terms.

Validation

• npm test -- --service-dir feishu__group-robot — passed, including 30 Service tests
• npm test -- --coverage --service-dir feishu__group-robot — passed; 99.93% lines, 92.75% branches, 98.83% functions
• npm run validate -- --service-dir feishu__group-robot — Service validation passed
• npm run pack:check — passed
• task build — passed
• task lint — passed
• node scripts/service-package-smoke.mjs --service-dir feishu__group-robot — import, Instance, capset, catalog, and Connect routing passed
• manual test-application verification covered group text delivery, approval Bot delivery, approval create/read/cancel, and contact reads

Two unrelated upstream baseline issues were intentionally not included in this change:

• repository-wide Service validation currently needs the executable-bit fix already proposed in fix: mark service bin entries executable #487
• task test on macOS reaches the existing /private/var/... versus /var/... path assertion in TestResolveImportSourceTransferModes; the Feishu Service tests and all other focused gates above pass

[monkeyscan]

评审任务执行失败。