feat: Mattermost channel handler (DM mode)

[msaidf]

Changes

Adds native Mattermost support to GoClaw, enabling DM-based agent interactions through Mattermost servers.

Files:

• internal/channels/mattermost/channel.go — channel implementation with WebSocket connection
• internal/channels/mattermost/factory.go — channel factory and config
• internal/channels/mattermost/send.go — message sending logic
• internal/config/config_channels.go — Mattermost config schema

Testing

Verified on a live deployment with 9 Mattermost bot accounts — all agents respond correctly in DM mode.

[mrgoonie]

Summary: This is a useful direction, but this PR should not merge as-is. It adds a second, partial Mattermost implementation while an older Mattermost PR already covers the same channel surface more broadly.

Risk level: Medium

Mandatory gates:

• Duplicate/prior implementation: overlap found with open PR #430 (feat: add Mattermost channel support in web dashboard), which already adds internal/channels/mattermost/*, config wiring, tests, and UI integration.
• Project standards: issue found — this PR adds ~814 lines with no Mattermost tests and no UI/schema/i18n integration for DB-created channel instances.
• Strategic necessity: clear value, but the implementation should be consolidated with #430 or explicitly supersede it instead of creating competing Mattermost channel code.
• CI/checks: missing/no checks reported for this branch.

Findings:

• Important: Duplicate/overlap risk. #430 is still open and implements the same Mattermost channel type plus broader files (internal/channels/mattermost/*, config, gateway registration, UI channel schema/i18n). Please either coordinate with #430 and make one successor PR, or explain why this narrower DM-only implementation supersedes #430 and close/retarget the duplicate path.
• Important: No regression tests for the new channel. The PR introduces polling, API request helpers, chunking, upload, and DB credential parsing, but there are no tests for config normalization, chunkText, send/create-post behavior, first-poll watermark behavior, or error handling. At minimum, add unit tests around the pure helpers and HTTP-client behavior using a test server.
• Important: SSRF/internal egress policy needs an explicit decision. server_url is used directly for authenticated outbound HTTP calls. That may be acceptable for operator-configured channel instances, but recent provider/web-fetch work is tightening internal URL boundaries; this PR should document the trust boundary and add validation or an explicit “operator configured Mattermost base URL” policy so this does not become an unreviewed internal-network dialer.

Next step: consolidate with #430 or clearly mark this PR as the chosen successor, add the missing tests, and document/validate the Mattermost server_url trust boundary before re-review.