Summary

DingTalk was the only messaging platform without group-mention gating or a per-user allowlist. Slack, Telegram, Discord, WhatsApp, Matrix, and Mattermost all expose these knobs via `config.yaml` + matching env vars; this change closes the gap for DingTalk using the same surface.

Config surface

```yaml
platforms:
dingtalk:
enabled: true
require_mention: true # env: DINGTALK_REQUIRE_MENTION
mention_patterns: # env: DINGTALK_MENTION_PATTERNS (JSON array)
- "^hermes"
free_response_chats: # env: DINGTALK_FREE_RESPONSE_CHATS (csv)
- "cidABC=="
allowed_users: # env: DINGTALK_ALLOWED_USERS (csv)
- "staff_1234"
```

Semantics (mirrors Telegram)

• DMs are always accepted, subject to `allowed_users`.
• Group messages are accepted only when one of:
  • chat ID is in `free_response_chats`
  • `require_mention` is disabled
  • bot was @mentioned (`dingtalk_stream` sets `is_in_at_list`)
  • text matches a configured regex wake-word
• `allowed_users` matches sender's `sender_id` or `sender_staff_id` case-insensitively; a single `"*"` disables the check.

Rationale

Without this, any DingTalk user in a group chat can trigger the bot, which makes DingTalk less safe to deploy than the other platforms. A user's `config.yaml` today already accepts `require_mention` for dingtalk (the yaml loader silently lets it pass), but the value was ignored by the adapter.

Test plan

• Syntax check (`python -m ast`) on both modified files
• Unit-level smoke test of the new helpers:
  • `_dingtalk_require_mention` reads from `extra` and env with correct precedence
  • `_compile_mention_patterns` handles list / JSON / csv / newline-separated inputs
  • `_is_user_allowed` is case-insensitive, wildcard `"*"` disables, empty allowlist is permissive
  • `_message_matches_mention_patterns` behaves correctly for match/no-match
• Integration test in a real DingTalk group (reviewer-side or future follow-up)

Files changed

• `gateway/config.py` — +18 lines, yaml → env var bridge (parallel to Telegram block)
• `gateway/platforms/dingtalk.py` — +142 lines, adapter helpers + gate in `_on_message`

No behaviour change when the new config keys are absent (opt-in).