Harden setup allow_from defaults

[q107580018]

Summary

• default feishu setup and weixin setup to merge the bound user into allow_from
• preserve allow_from = "*" and deduplicate/compress comma-separated ids when appending
• add config regression tests for empty, append, and wildcard cases

Test Plan

• go test ./cmd/cc-connect ./config
• go test ./... (currently fails on existing unrelated tests in core and platform/wecom)

[chenhg5]

LGTM. Improved security defaults for setup.

Review summary:

• ✅ feishu setup and weixin setup now merge bound user into allow_from
• ✅ Preserves allow_from = *
• ✅ Deduplicates comma-separated IDs
• ✅ Tests added
• ✅ CI passes

Better security posture for new installations.