feat(channels): Expand Matrix channel (E2EE, sync token, history, allowlists, mentions)

## Summary

Track work to bring the built-in **Matrix** channel closer to production-ready behavior: media, structured mentions, per-room policy, sync persistence, optional E2EE, and documentation.

## Motivation

- Reduce gap vs. internal / bridge-style Matrix bots (manager–worker style deployments).
- Support encrypted rooms, reliable group vs DM handling, and better UX (read receipts, typing, Markdown HTML).

## Scope (high level)

- **Auth**: `access_token` and optional `username`/`password`/`device_name`.
- **Allowlists**: `allow_from`, `group_allow_from`, `dm_policy`/`group_policy`, per-room `groups` (`requireMention`, `autoReply`, etc.).
- **Mentions**: inbound detection (`m.mentions`, matrix.to HTML, plain MXID); outbound `m.mentions` + pill when replying with `sender_id` in meta.
- **Context**: per-room history buffer (`history_limit`); sync cursor file under `COPAW_WORKING_DIR` (`matrix_sync_token`).
- **Media**: mxc download/upload; `vision_enabled` gate for images to the model.
- **Optional E2EE**: `encryption` + matrix-nio store; requires **python-olm** / **libolm** where used.
- **Docs**: `website/public/docs/channels.en.md` and `channels.zh.md` updated.

## Security / privacy

- Tokens and olm/Megolm material must stay on the user machine; document `COPAW_WORKING_DIR` and crypto store paths for self-hosted users.

## Verification

- Local: `pre-commit run --all-files`, `pytest`.
- Runtime: E2E checks in **Hiclaw** with **manager + worker** topology (encrypted rooms, allowlists, restart with sync token) — screenshots can be attached in the linked PR.

## PR

A PR will reference this issue when opened.