NS-578: Add WhatsApp dashboard pairing flow

[shannonsands]

Summary

Adds dashboard-first WhatsApp pairing for hosted users who do not have CLI access to hermes whatsapp.

• Adds WhatsApp onboarding REST endpoints for starting, polling, applying, and cancelling QR pairing sessions.
• Updates the WhatsApp bridge with JSON pairing events, linked-account metadata, and debug events gated behind WHATSAPP_DEBUG.
• Adds a Channels-page WhatsApp QR setup panel with bot/self-chat mode selection, linked-account state, save-and-restart flow, and safer preserved allowlist behavior.
• Surfaces safe WhatsApp setup metadata so the dashboard can remember saved mode without exposing phone numbers.
• Updates adapter copy so users are pointed to dashboard pairing as well as CLI pairing.

Why

Hosted Hermes Cloud users cannot run the CLI pairing flow directly. The existing dashboard only reported that WhatsApp needed pairing, leaving users stuck at the exact moment they needed a QR code.

Notes

• Self-chat remains intentionally scoped to Message Yourself; group/bot-number flows are left out of this PR.
• Blank allowed-users in the QR apply flow now preserves the existing allowlist instead of clearing it unexpectedly.
• The local debug session also confirmed WhatsApp transport, home-channel setup, and Nous provider auth after copying an existing local OAuth token into the root Hermes home; that auth copy is not part of this repo diff.

Validation

• scripts/run_tests.sh tests/hermes_cli/test_whatsapp_onboarding.py -q
• python -m py_compile hermes_cli/web_server.py plugins/platforms/whatsapp/adapter.py
• node --check scripts/whatsapp-bridge/bridge.js
• npm run typecheck --workspace web
• git diff --check