feat(gateway): Phase 3 quick fixes — bot filter, fallback, logging, docs (#1173)

* feat(gateway): bot filter env vars, create_thread fallback, attachment logging

- Add GATEWAY_ALLOW_BOT_MESSAGES / GATEWAY_TRUSTED_BOT_IDS env vars to
  process_gateway_event(). Bot messages are now passthrough when explicitly
  allowed or sender is in trusted list. (Issue #1172 task 1)
- Send user-facing fallback message when create_thread fails instead of
  silently falling back to channel. (Issue #1172 task 6)
- Log warning when attachment has neither path nor data. (Issue #1172 task 7)

* docs: add unified mode env vars to config-reference

Documents all GATEWAY_* env vars including security gating
(ALLOW_ALL_CHANNELS/USERS defaults, ALLOW_BOT_MESSAGES,
TRUSTED_BOT_IDS) with production checklist warning.

Issue #1172 task 5.

---------

Co-authored-by: chaodu-agent <chaodu-agent@openab.dev>

Author: chaodu-agent

crates/openab-core/src/config.rs

@@ -462,6 +462,16 @@ pub struct GatewayConfig {
     pub allowed_channels: Vec<String>,
     #[serde(default)]
     pub allowed_users: Vec<String>,
+    /// Allow messages from bots. Default: false.
+    /// NOTE: Intentionally `bool` (not `AllowBots` enum) — the gateway adapter
+    /// only needs on/off since @mention gating is handled separately by
+    /// `bot_username` + `should_skip_event`. Discord/Slack use `AllowBots` because
+    /// their adapters embed mention-mode logic internally.
+    #[serde(default)]
+    pub allow_bot_messages: bool,
+    /// Bot IDs that bypass the bot filter even when allow_bot_messages is false.
+    #[serde(default)]
+    pub trusted_bot_ids: Vec<String>,
     /// Enable streaming (typewriter) mode — requires gateway platform to support message editing.
     /// Defaults to `false`, so gateway platforms (Telegram / LINE / Google Chat) are **send-once
     /// by default**. By default send-once delivers **only the final answer block** — the text after