feat: add Z12/Z13 bind APIs, stock import, and sync docs

Enable auto default sync channels on agent activate, bind-code/phone confirm flows, publish ALTER, and align admin/yuheng docs with the production bind path.

platform/internal/logic/applogic/agents.go

@@ -111,6 +111,13 @@ func (l *AgentAdminLogic) Create(req *types.AgentCreateReq) (*types.AgentCreateR
 	if err != nil {
 		return nil, err
 	}
+	if acc2, err := l.ensureAgentSyncBind(acc); err == nil && acc2 != nil {
+		acc = acc2
+	} else if err != nil {
+		// 自动绑通道失败不阻断创建，但返回提示
+		l.attachRole(acc)
+		return &types.AgentCreateResp{Account: *acc, ClientSecret: secret}, nil
+	}
 	l.attachRole(acc)
 	return &types.AgentCreateResp{Account: *acc, ClientSecret: secret}, nil
 }
@@ -194,6 +201,12 @@ func (l *AgentAdminLogic) Update(agentID int64, req *types.AgentUpdateReq) (*age
 	if err != nil {
 		return nil, err
 	}
+	// Z12c：启用为 active 且无通道时自动绑默认同步通道
+	if acc.Status == agentstore.StatusActive {
+		if acc2, err := l.ensureAgentSyncBind(acc); err == nil && acc2 != nil {
+			acc = acc2
+		}
+	}
 	l.attachRole(acc)
 	return acc, nil
 }
@@ -239,7 +252,7 @@ func (l *AuthLogic) IssueClientCredentials(clientID, clientSecret string) (*type
 	if secret == "" {
 		secret = l.svcCtx.JWT.AccessSecret
 	}
-	return &types.TokenResp{
+	resp := &types.TokenResp{
 		AccessToken: token,
 		TokenType:   "Bearer",
 		ExpiresAt:   exp,
@@ -252,5 +265,7 @@ func (l *AuthLogic) IssueClientCredentials(clientID, clientSecret string) (*type
 		AgentID:     acc.AgentID,
 		Permissions: append([]string{}, acc.Perms...),
 		AppSlugs:    append([]string{}, acc.AppSlugs...),
-	}, nil
+	}
+	fillAgentSyncOnToken(resp, acc)
+	return resp, nil
 }