Summary

• normalize WeCom inbound aeskey values before decrypting downloaded attachments
• accept urlsafe base64 and restore missing padding before decoding
• add regression coverage for unpadded urlsafe keys and cached inbound media decryption

Fixes #11890

Testing

• python3 -m pytest -o addopts='' tests/gateway/test_wecom.py -k 'decrypt_file_bytes_accepts_unpadded_urlsafe_aes_key or cache_media_decrypts_url_payload_before_writing or decrypt_file_bytes_round_trip'
• python3 -m pytest -o addopts='' tests/gateway/test_wecom.py