fix: skip sender allowlist check for group messages in HandleMessage (#101)

HandleMessage() always checked IsAllowed(senderID), which re-gates
individual senders against the allowlist even after the channel-specific
group policy (checkGroupPolicy) already approved access.

This caused group members who weren't individually listed in AllowFrom
to be silently blocked — even when GroupPolicy was set to "open" or the
group ID was in the allowlist.

Affected channels: Zalo Personal, Slack (any channel using HandleMessage
with peerKind "group"). Telegram was unaffected because it publishes
directly to the bus.

Now HandleMessage only enforces the allowlist for DMs. Group access
control is fully delegated to each channel's checkGroupPolicy.

Co-authored-by: Luvu182 <208665161+Luvu182@users.noreply.github.com>

internal/channels/channel.go

@@ -271,7 +271,12 @@ func (c *BaseChannel) ValidatePolicy(dmPolicy, groupPolicy string) {
 // This is the standard way for channels to forward received messages.
 // peerKind should be "direct" or "group" (see sessions.PeerDirect, sessions.PeerGroup).
 func (c *BaseChannel) HandleMessage(senderID, chatID, content string, media []string, metadata map[string]string, peerKind string) {
-	if !c.IsAllowed(senderID) {
+	// For DMs, enforce the allowlist as a safety net.
+	// For group messages, skip this check — group access is already enforced
+	// by the channel-specific group policy (checkGroupPolicy / CheckPolicy).
+	// Re-checking the sender here would incorrectly block users who are not
+	// individually listed but are in an allowed (or open-policy) group.
+	if peerKind != "group" && !c.IsAllowed(senderID) {
 		return
 	}