fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/tests/Feature/ChannelsApiTest.php

@@ -38,6 +38,11 @@ class ChannelsApiTest extends TestCase
         // telegram подключается только через /start, не через API
         $this->postJson('/me/channels', ['type' => 'telegram', 'config' => ['chat_id' => 1]], $this->as)
             ->assertStatus(422);
+        // только http/https-схемы
+        $this->postJson('/me/channels', ['type' => 'webhook', 'config' => ['deliver_url' => 'ftp://x/y', 'presence_url' => 'ftp://x/y']], $this->as)
+            ->assertStatus(422)->assertJsonValidationErrors(['config.deliver_url', 'config.presence_url']);
+        $this->postJson('/me/channels', ['type' => 'webhook', 'config' => ['deliver_url' => 'http://home.local/x', 'presence_url' => 'http://home.local/x']], $this->as)
+            ->assertCreated();
     }
 
     public function test_web_channel_cannot_be_deleted_and_foreign_channel_is_404(): void