- normalizeAllowList/isSenderAllowed in slash-http.ts now matches the
websocket monitor: strips mattermost:/user:/@ prefixes and supports
the '*' wildcard, so configs that work for WS also work for slash cmds
- registerSlashCommandRoute extracts pathname from explicit callbackUrl
and registers it alongside callbackPath, so callbacks hit a registered
route even when callbackUrl uses a non-default pathname
Addresses Codex review round 5 (P1 + P2).
81087ecb6b