refactor(channels): centralize runtime group policy handling

src/web/inbound/access-control.ts

@@ -1,5 +1,8 @@
 import { loadConfig } from "../../config/config.js";
-import { resolveRuntimeGroupPolicy } from "../../config/runtime-group-policy.js";
+import {
+  resolveOpenProviderRuntimeGroupPolicy,
+  warnMissingProviderGroupPolicyFallbackOnce,
+} from "../../config/runtime-group-policy.js";
 import { logVerbose } from "../../globals.js";
 import { buildPairingReply } from "../../pairing/pairing-messages.js";
 import {
@@ -26,12 +29,10 @@ function resolveWhatsAppRuntimeGroupPolicy(params: {
   groupPolicy: "open" | "allowlist" | "disabled";
   providerMissingFallbackApplied: boolean;
 } {
-  return resolveRuntimeGroupPolicy({
+  return resolveOpenProviderRuntimeGroupPolicy({
     providerConfigPresent: params.providerConfigPresent,
     groupPolicy: params.groupPolicy,
     defaultGroupPolicy: params.defaultGroupPolicy,
-    configuredFallbackPolicy: "open",
-    missingProviderFallbackPolicy: "allowlist",
   });
 }
 
@@ -105,11 +106,12 @@ export async function checkInboundAccessControl(params: {
     groupPolicy: account.groupPolicy,
     defaultGroupPolicy,
   });
-  if (providerMissingFallbackApplied) {
-    logVerbose(
-      'whatsapp: channels.whatsapp is missing; defaulting groupPolicy to "allowlist" (group messages blocked until explicitly configured).',
-    );
-  }
+  warnMissingProviderGroupPolicyFallbackOnce({
+    providerMissingFallbackApplied,
+    providerKey: "whatsapp",
+    accountId: account.accountId,
+    log: (message) => logVerbose(message),
+  });
   if (params.group && groupPolicy === "disabled") {
     logVerbose("Blocked group message (groupPolicy: disabled)");
     return {