feat(line): full [line] section — credentials + connection config-first

[chaodu-agent]

Summary

Extend [line] beyond the trust fields (#1365) to cover ALL LINE settings, per the config-first invariant: [line] config → LINE_* env → default. Config always wins; env is fallback only.

Fields to add

Field	Env fallback	Notes
channel_secret	LINE_CHANNEL_SECRET	L1 webhook HMAC key — once config-supplied, the #1373 L1 warning must account for it (bridge to gateway AppState)
channel_access_token	LINE_CHANNEL_ACCESS_TOKEN	Reply/Push API + media download
webhook_path	— (currently hardcoded /webhook/line)	Bring in line with other platforms

Tasks

• Extend LineConfig + ResolvedLine with per-field resolve() (empty-string ${} expansion treated as unset — follow TelegramConfig::resolve)
• Bridge struct + AppState::apply_line_config() (mirror GatewayTelegramConfig / apply_telegram_config; keeps openab-gateway free of openab-core dependency)
• Unified path wires resolved values before warn_unenforceable_l1
• docs/line.md + config-reference.md: [line] as primary, env as fallback
• Regression: env-only deployments unchanged; config wins per-field when both set

Refs

Umbrella: #1375 · Reference pattern: TelegramConfig (#1297) · Trust slice: #1365 · L1 warning: #1373

[github-actions]

⚠️ This issue is missing the following required information and will not be processed until completed:

• Use Case

Please edit this issue to fill in the missing fields. Thank you!

Tip: Use headings like ## Description or ### Description — common synonyms (e.g. ## Problem, ## Reproduction, ## Motivation) are also accepted.