feat(slack): P0+P1 fixes - path security, ACK retry, gap analysis

[hrygo]

Summary

Addresses critical feature gaps identified in Issue #21 (Slack vs OpenClaw comparison report):

P0 - Security & Reliability:

• ✅ Path traversal attack protection (blocks access to /etc, /var, /root, etc.)
• ✅ Socket Mode ACK retry with exponential backoff (fixes duplicate message processing)
• ✅ Sensitive path detection and blocking

P1 - Code Quality:

• ✅ Comprehensive unit tests for expandPath (93.8% coverage)
• ✅ Fix duplicate event handler call in Socket Mode
• ✅ Proper Slack API acknowledgment (3-second requirement)

Changes

Security Fixes (chatapps/setup.go)

• Add expandPath() with ~ expansion and path cleaning
• Add isSensitivePath() to block system directories
• Block path traversal attempts (e.g., ../etc/passwd)

Reliability Fixes (chatapps/slack/socket_mode.go)

• Remove duplicate handleEventsAPI() call
• Implement sendACKWithRetry() with exponential backoff
• Slack-compliant ACK response (envelope_id within 3 seconds)

Documentation (docs/chatapps/)

• Add gap analysis report (Issue Slack 实现与 OpenClaw 差距分析报告 - 功能缺失与改进路线 #21)
• Update slack-gap-analysis.md with implementation roadmap
• Update chatapps-slack.md with new security features

Configuration (chatapps/configs/slack.yaml)

• Document path security features
• Document ACK retry mechanism
• Add system prompt injection explanation
• Add troubleshooting examples

Testing

# Run all tests
go test ./chatapps/... -v

# Test expandPath
go test ./chatapps/... -run TestExpandPath

# Build verification
go build ./...

# Linter check
golangci-lint run ./chatapps/...

Test Coverage:

• expandPath: 93.8%
• isSensitivePath: 100%
• All existing tests: ✅ PASS

Verification

• go test ./... - All tests pass
• go build ./... - Build succeeds
• golangci-lint run - No issues
• Path security blocks sensitive directories
• ACK retry handles connection failures

Related Issues

• Resolves Slack 实现与 OpenClaw 差距分析报告 - 功能缺失与改进路线 #21 - Slack 实现与 OpenClaw 差距分析报告
• Fixes duplicate message processing bug
• Implements P0 security requirements from gap analysis

Remaining Gaps (Future Work)

Per Issue #21 analysis, the following features are still pending:

P0 (Critical):

• Slash Commands support
• Slack Actions API (sendMessage, editMessage, etc.)
• Block Kit support
• Multi-account support

P1 (Enhancement):

• Streaming/typing indicators
• Advanced Markdown conversion (tables, lists)
• DM/Channel policies
• Interactive messages

See docs/chatapps/slack-gap-analysis.md for complete roadmap.