Several apps per platform and the IM apps list #1110

Parent: #1107 · ADR-0142 · after slice 2

What to build

• Schema: drop the unique index messaging_binding_bot_platform. Keep messaging_binding_account and messaging_binding_principal, so one app still belongs to one Bot.
• Host:
  • Remove the bot_slug = ? AND platform = ? conflict from the identity bind and authorize commands in outbound.ts.
  • Check every per-platform lookup that assumed one Binding per platform: snapshot, pairing receivers, approvals destinations, defaults inheritance.
  • Shared-source replies (ADR-0122) accept the responder's explicit or implicit entry and refuse reply-target-ambiguous when the responder has two apps in that conversation.
  • Expose an app-usage projection that lists each Provider account with its bound Bot, if any.
• Client:
  • The Bind app dialog lists only apps no Bot uses (hidden, not merely disabled) and allows a second app of the same platform.
  • The External identities entry lists every app, grouped by platform.
  • New IM apps (IM 应用) list in Bot settings: app, platform, connection state, used by Bot (links to that Bot's DM), unbound apps, and a link to the Provider settings for credentials.

Acceptance criteria

• One Bot binds two Lark apps. Each receives its own DMs and mentions into the same Inbox with distinct source attribution, and replies go out through the receiving app.
• An app bound to Bot A is not offered in Bot B's dialog. A direct command still refuses with binding-conflict.
• The IM apps list shows the correct Bot for every app and updates live after bind and unbind.
• A shared reply by a Bot with two apps in the same group refuses with a clear message. With one app, it works.
• Migration test covers dropping the index on a database with existing bindings.
• Screenshots zh/en, light/dark.

Blocked by

Slice 2.