fix: restore WEIXIN_TOKEN from persisted account file on startup

After container rebuild, WEIXIN_TOKEN was lost because HF Space Secrets
don't include it (it's obtained via QR scan). The gateway's own auto-restore
logic requires WEIXIN_ACCOUNT_ID + account JSON file, but token was empty
because the account file may have been corrupted during crash loops.

Now start.sh explicitly reads the token from the persisted account JSON
file (/data/hermes/weixin/accounts/<id>.json) and exports WEIXIN_TOKEN
before the gateway starts, ensuring the weixin adapter has valid credentials.

start.sh

@@ -33,22 +33,41 @@ if [ ! -L "$WEIXIN_DIR" ]; then
     echo "Symlink: weixin -> /data/hermes/weixin"
 fi
 
-# Auto-discover WeChat account_id from persisted session files
+# Auto-discover WeChat account_id AND token from persisted session files
 # The QR login flow saves credentials to ~/.hermes/weixin/accounts/<account_id>.json
-# We export it as WEIXIN_ACCOUNT_ID so the gateway picks it up without manual config
-if [ -z "$WEIXIN_ACCOUNT_ID" ]; then
-    ACCOUNTS_DIR="/data/hermes/weixin/accounts"
-    if [ -d "$ACCOUNTS_DIR" ]; then
-        LATEST=$(find "$ACCOUNTS_DIR" -name "*.json" ! -name "*.context-tokens.json" ! -name "*.sync.json" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}')
-        if [ -n "$LATEST" ]; then
-            DISCOVERED_ID=$(basename "$LATEST" .json)
-            export WEIXIN_ACCOUNT_ID="$DISCOVERED_ID"
-            echo "Auto-discovered WEIXIN_ACCOUNT_ID=$DISCOVERED_ID"
+# We export both WEIXIN_ACCOUNT_ID and WEIXIN_TOKEN so the gateway picks them up
+ACCOUNTS_DIR="/data/hermes/weixin/accounts"
+if [ -z "$WEIXIN_ACCOUNT_ID" ] && [ -d "$ACCOUNTS_DIR" ]; then
+    LATEST=$(find "$ACCOUNTS_DIR" -name "*.json" ! -name "*.context-tokens.json" ! -name "*.sync.json" -type f -printf '%T@ %p\n' 2>/dev/null | sort -rn | head -1 | awk '{print $2}')
+    if [ -n "$LATEST" ]; then
+        DISCOVERED_ID=$(basename "$LATEST" .json)
+        export WEIXIN_ACCOUNT_ID="$DISCOVERED_ID"
+        echo "Auto-discovered WEIXIN_ACCOUNT_ID=$DISCOVERED_ID"
+    else
+        echo "No WeChat account files found in $ACCOUNTS_DIR"
+    fi
+fi
+
+# Also restore WEIXIN_TOKEN from persisted account file if not already set
+# This is needed because .env generated from HF Space Secrets doesn't contain WEIXIN_TOKEN
+if [ -z "$WEIXIN_TOKEN" ] && [ -n "$WEIXIN_ACCOUNT_ID" ]; then
+    ACCOUNT_FILE="$ACCOUNTS_DIR/${WEIXIN_ACCOUNT_ID}.json"
+    if [ -f "$ACCOUNT_FILE" ]; then
+        DISCOVERED_TOKEN=$(python3 -c "
+import json, sys
+try:
+    d = json.load(open('$ACCOUNT_FILE'))
+    print(d.get('token', ''))
+except: print('')
+" 2>/dev/null)
+        if [ -n "$DISCOVERED_TOKEN" ]; then
+            export WEIXIN_TOKEN="$DISCOVERED_TOKEN"
+            echo "Restored WEIXIN_TOKEN from persisted account file"
         else
-            echo "No WeChat account files found in $ACCOUNTS_DIR"
+            echo "WARNING: WeChat account file found but token is empty — QR re-scan needed"
         fi
     else
-        echo "WeChat accounts directory not found (first-time QR login needed)"
+        echo "WARNING: WeChat account file $ACCOUNT_FILE not found — QR scan needed"
     fi
 fi