feat(wechat): add wechat_allowed_users gating, mirror QQ adapter pattern

[shaun0927]

Closes #95.

Problem

frontends/wechatapp.py is the only chat adapter that does not look at
an allow-list. Every other adapter under frontends/ reads
<platform>_allowed_users from mykey.py and rejects unknown senders:

Adapter	Allow-list key
tgapp.py	tg_allowed_users (non-empty required)
fsapp.py	fs_allowed_users
qqapp.py	qq_allowed_users
dingtalkapp.py	dingtalk_allowed_users
wecomapp.py	wecom_allowed_users
wechatapp.py	(none)

After python frontends/wechatapp.py scans the QR code, anyone who
messages the bound personal WeChat account drives the agent — every
tool the agent has (code_run, file_read, file_write, web control)
is reachable to any contact, with no logging or rejection path.

Fix

Mirror the QQ adapter pattern that PR #25 established:

ALLOWED = {str(x).strip() for x in mykeys.get('wechat_allowed_users', []) if str(x).strip()}
...
if not public_access(ALLOWED) and uid not in ALLOWED:
    print(f'[WX] unauthorized user: {uid}', file=sys.__stdout__)
    return

Three deliberate decisions:

1. Reuse chatapp_common.public_access() rather than inlining
   not allowed or '*' in allowed, so the semantics stay locked to
   the same definition the other adapters use. If public_access
   ever changes, wechat picks it up for free.
2. Default behavior is unchanged — existing setups that don't set
   wechat_allowed_users get ALLOWED == set(), public_access()
   returns True, and every message still reaches the agent. This
   matches qq/dingtalk/wecom/fs exactly. (Telegram is the
   stricter exception that hard-fails on empty; not adopted here to
   avoid breaking existing wechat installs without warning.)
3. Log line format matches qq/dingtalk: [WX] unauthorized user: <uid>, so a user grepping temp/wechatapp.log sees the
   same shape as the other adapters' logs.

mykey_template.py gets the matching # wechat_allowed_users = ['from_user_id']
comment line in the existing chat-platform block so the option is
discoverable.

Verification

• python -m py_compile frontends/wechatapp.py mykey_template.py — passes.
• Existing wechat installs (no wechat_allowed_users in mykey) keep working
  unchanged because ALLOWED is empty → public_access(ALLOWED) is True
  → the new check is skipped.
• New installs that opt in via wechat_allowed_users = ['<from_user_id>']
  get the same allow-list semantics as qqapp.py (uid must be in the set).

Diff size: +8 / -0 across 2 files.