feat(studio): add reusable Feishu bot setup card

[evanlowe]

Summary

• add a reusable Feishu bot setup card to the final Agent Studio deployment step
• keep the card at a fixed 112 px height before and after flipping, with automatic and manual configuration tabs
• integrate Feishu's official PersonalAgent app-registration device flow for QR creation and polling
• return credentials only after user authorization, then atomically refill App ID and App Secret
• isolate reusable backend setup logic under frontend/server/feishu_bot_setup/
• include rebuilt Studio web assets

Integration notes

• POST accounts.feishu.cn/oauth/v1/app/registration with action=begin creates the official registration session
• action=poll is rate-limited according to the provider interval and handles pending, slow-down, denial, expiry, and Feishu/Lark tenant brand switching
• credentials are cached only in the in-memory server session after a successful authorization; App Secret is never logged
• the existing manual App ID/App Secret path remains available

Verification

• real Feishu QR authorization completed successfully; the backend returned non-empty App ID and App Secret without exposing either value in logs
• frontend credential refill now updates both fields atomically; regression tests cover the contract
• npm test — 966 passed
• npm run build — passed
• backend Feishu setup tests — 11 passed
• Ruff — passed
• Pyright — 0 errors, 0 warnings
• pre-commit and hardcoded-secret scan — passed
• visual QA reviewed at 1440×900 and 390×844; the flipped card remains 112 px high with no card-level clipping or horizontal overflow
• GitHub CI — all required checks passed