feat: Public chat link email whitelist and access requests

[vybe]

Problem

Public chat links with email verification provide no real security — anyone can enter any email and get access. There's no whitelist or approval gate, making the verification step meaningless.

Solution

1. Default behavior: Require email authentication for public chat links
2. Email whitelist: Add a configurable whitelist of allowed email addresses/domains
3. Access requests: When a non-whitelisted email tries to access, show an "access request" flow that notifies the agent owner for approval
4. Integrate with existing Email Whitelist settings in Settings panel

Acceptance Criteria

• Public chat links require email authentication by default
• Admin can configure allowed emails/domains per agent or globally
• Non-whitelisted users see an access request form
• Agent owner is notified of pending access requests
• Approved emails are added to the whitelist automatically

[vybe]

Filed #311 as an umbrella — proposing this be reframed as the web surface of a unified channel access control primitive (verified-email identity + per-agent allow-list + access requests), so Telegram (#297, #301) and Slack inherit the same model instead of each growing a parallel auth layer.

Concretely, the verification + allow-list + access-request logic lives once in the router, and each adapter only implements resolve_verified_email(message). Memory (MEM-001) then keys on verified email across channels automatically.

This issue would land as the public-link / web portion of #311's sub-task list.

[vybe]

Readiness triage 2026-07-03: superseded — #311 shipped unified channel access control (require_email / open_access flags, access_requests approval flow, email-whitelist integration), covering the whitelist + access-request design proposed here.