fix(zalo_personal): data races in policy, directory perms, Makefile --no-cache

- Fix 2 data races in policy.go: sendPairingReply and checkGroupPolicy
  accessed c.sess without the read lock — use c.session() accessor
- Fix credentials directory permissions: 0755 → 0700 to prevent other
  users from listing contents
- Revert Makefile --no-cache (debugging leftover that disables Docker
  layer caching)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Makefile

@@ -19,8 +19,7 @@ version:
 COMPOSE = docker compose -f docker-compose.yml -f docker-compose.managed.yml -f docker-compose.selfservice.yml
 
 up:
-	$(COMPOSE) build --no-cache
-	$(COMPOSE) up -d
+	$(COMPOSE) up -d --build
 
 down:
 	$(COMPOSE) down

internal/channels/zalo/personal/auth.go

@@ -92,7 +92,7 @@ func saveCredentials(path string, cred *protocol.Credentials) error {
 	if cred == nil {
 		return nil
 	}
-	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
 		return err
 	}
 	data, err := json.MarshalIndent(cred, "", "  ")

internal/channels/zalo/personal/policy.go

@@ -50,7 +50,8 @@ func (c *Channel) checkDMPolicy(senderID, chatID string) bool {
 }
 
 func (c *Channel) sendPairingReply(senderID, chatID string) {
-	if c.pairingService == nil || c.sess == nil {
+	sess := c.session()
+	if c.pairingService == nil || sess == nil {
 		return
 	}
 
@@ -74,7 +75,7 @@ func (c *Channel) sendPairingReply(senderID, chatID string) {
 
 	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
 	defer cancel()
-	if _, err := protocol.SendMessage(ctx, c.sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
+	if _, err := protocol.SendMessage(ctx, sess, chatID, protocol.ThreadTypeUser, replyText); err != nil {
 		slog.Warn("zalo_personal: failed to send pairing reply", "error", err)
 	} else {
 		c.pairingDebounce.Store(senderID, time.Now())
@@ -103,7 +104,12 @@ func (c *Channel) checkGroupPolicy(senderID, groupID string, mentions []*protoco
 
 	// @mention gating: only process group messages that @mention the bot.
 	if c.requireMention {
-		if !isBotMentioned(c.sess.UID, mentions) {
+		sess := c.session()
+		botUID := ""
+		if sess != nil {
+			botUID = sess.UID
+		}
+		if !isBotMentioned(botUID, mentions) {
 			slog.Debug("zalo_personal group message skipped: not mentioned",
 				"group_id", groupID,
 				"sender_id", senderID,