lark-bot-permissions

# Grant Feishu scopes to a TaroCub bot (console import via browser) Productizes the manual flow: log into the Feishu developer console, bulk-import a scope group for a bot's app, 申请开通, verify it's live, restart the instance. ## When this is needed (and when it is NOT) - **Needed** — the *bot app* must receive/send something it can't yet: non-@ group messages (`im:message.group_msg`), broad chat/member admin, or any advanced family imported as a *tenant* scope. The QR registration auto-grants NONE of these; they require a console import + (for non-personal apps) a version publish. - **NOT needed** — "create a Doc/Sheet/Calendar event **as me**". Those run through the operator's **lark-cli user login** (full user scopes), not the bot app, so they already work. Don't send the user to the console for these. - **Creating a new bot** is a different step: `node dist/src/index.js lark setup --identity bot-only` (QR PersonalAgent registration). This skill is only the *permission* part for an app that already exists. ## Inputs - The **instance** name, e.g. `ccfcc3` (state dir `~/.cctb/<inst>`). - Which **feature/scope group**, e.g. "群里非@也回" → the `group-messages` group (`im:message`, `im:message.group_msg`). The exact JSON comes from step 1 — never hand-type scope strings. ## Step 1 — Get the exact import JSON, appId, and console URL from the bridge Do not guess scope names or URLs; the bridge prints them per feature group: ```bash env CCTB_LARK_STATE_DIR="$HO...