feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/repositories/channel_config_repository.go

@@ -0,0 +1,22 @@
+package repositories
+
+import (
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/enums"
+	"gorm.io/gorm"
+)
+
+// UpdatesConfigIfUnchanged prevents a stale read/modify/write from replacing a
+// concurrently tightened authentication policy or rotated channel secret. HEX is
+// available in SQLite and MySQL and compares exact bytes even when MySQL's text
+// column uses a case-insensitive or trailing-space-insensitive collation.
+func (r *channelRepository) UpdatesConfigIfUnchanged(db *gorm.DB, expected *models.Channel, columns map[string]any) (bool, error) {
+	if expected == nil || expected.ID <= 0 {
+		return false, nil
+	}
+	result := db.Model(&models.Channel{}).
+		Where("id = ? AND status <> ? AND updated_at = ?", expected.ID, enums.StatusDeleted, expected.UpdatedAt).
+		Where("HEX(COALESCE(config_json, '')) = HEX(?)", expected.ConfigJSON).
+		Updates(columns)
+	return result.RowsAffected == 1, result.Error
+}