fix(integrations): 重启后机器人要能自己接回来

上一版把双进程抢会话修了，但生产重启后仍然不收消息：`start_all()` 是进程启动时的
查询，那一刻没有工作区上下文，`bot_channel` 的 RLS 把行全藏起来，一行都查不到，
于是"页面上显示已连接，实际上没人在拉消息"。

- 迁移 0016 补一条只读策略：`current_setting('app.bot_list') = 'on'` 时允许 SELECT
  （只开 SELECT，防止顺手拿它改别人的通道）；
- `start_all()` 走 `active_channel_ids()`，先设这个 GUC 再列通道；
- 补测试 `test_startup_sees_logged_in_channels`。

backend/tests/test_wechat_bot.py

@@ -354,3 +354,26 @@ async def test_only_one_process_holds_the_polling_lease() -> None:
     third = await wechat_bot.acquire_lease(channel_id)
     assert third is not None, "前一个进程放手后，备用进程要能接上"
     await third.close()
+
+
+async def test_startup_sees_logged_in_channels(client: AsyncClient) -> None:
+    """重启后要能把已登录的通道接回来：没有工作区上下文时也得看得见（迁移 0016）。"""
+    user = await login(client)
+    ws = await create_workspace(client, user, "重启接管")
+    ws_id = uuid.UUID(ws["id"])
+
+    async with SessionFactory() as session:
+        await bind_tenant(session, ws_id, uuid.UUID(user["user_id"]))
+        channel = BotChannel(
+            workspace_id=ws_id,
+            kind="wechat_clawbot",
+            name="微信",
+            status="active",
+            bot_token_enc=wechat_ilink.encrypt_token("bot-token-x"),
+        )
+        session.add(channel)
+        await session.commit()
+        channel_id = channel.id
+
+    ids = await wechat_bot.active_channel_ids()
+    assert channel_id in ids, "启动时看不见已登录通道，重启后机器人就静默失联了"