fix: live-validation fixes (list-coercion, .env session loading, smoke summary)

Cleanup after successful live validation (10 real customers scraped+stored):

- app/config.py: add yk_userid / yk_company / yk_cookie Settings fields so
  existing-session creds can be supplied via .env (bypasses programmatic
  login for validation with a live browser session).
- app/storage/repos.py: coerce list values to ';'-joined strings in
  _build_column_values. Fixes a real bug: the live friends-list API returns
  Customer.deptRoute as a LIST, but dept_route is a scalar String(255)
  column. raw_json still preserves the original list (no data loss).
- scripts/smoke_wechat.py:
  * Revert build_client_from_env to read os.environ ONLY (no get_settings
    fallbacks), so the monkeypatch.setenv unit tests stay hermetic and the
    real .env stops leaking in. 3 previously-red tests green again.
  * Add _push_settings_into_environ() (Settings -> os.environ, real env
    wins, only fills gaps) and call it as the first line of main(); so the
    smoke run still honors .env without the pure builder depending on
    Settings. .env -> Settings -> os.environ (once) -> build_client_from_env.
  * Keep the await _print_summary fix from validation.
- tests/test_repos.py: regression test for list dept_route coercion
  (stored joined 'A;B', raw_json keeps the list).

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/tests/test_repos.py

@@ -216,6 +216,42 @@ async def test_upsert_customer_keeps_raw_json():
         await engine.dispose()
 
 
+async def test_upsert_customer_coerces_list_dept_route_to_joined_string():
+    """A list ``dept_route`` is stored joined ("A;B"); raw_json keeps the list.
+
+    Regression for the live-validation fix: the real yunke friends-list API
+    returns ``deptRoute`` as a LIST of dept ids, but ``Customer.dept_route`` is
+    a scalar String(255) column. Without the list->";"-join coercion in
+    :func:`_build_column_values` the bind raises (cannot store a list in a
+    String column). This test pins the coercion: the column holds the joined
+    scalar, while ``raw_json`` still carries the original list verbatim so no
+    information is lost.
+    """
+    engine = await _make_engine()
+    try:
+        SessionLocal = async_sessionmaker(engine, expire_on_commit=False)
+        async with SessionLocal() as session:
+            rec = {
+                "friend_id": "wxid_list",
+                "channel": "wechat",
+                "dept_route": ["A", "B"],  # list upstream shape
+            }
+            await upsert_customer(session, rec)
+            await session.commit()
+
+            fetched = (
+                await session.execute(
+                    sa.select(Customer).where(Customer.friend_id == "wxid_list")
+                )
+            ).scalar_one()
+            # Stored as the joined scalar string.
+            assert fetched.dept_route == "A;B"
+            # The verbatim list is still recoverable from raw_json.
+            assert fetched.raw_json["dept_route"] == ["A", "B"]
+    finally:
+        await engine.dispose()
+
+
 async def test_upsert_customers_batch_returns_count():
     """Batch upsert returns the number of records processed."""
     engine = await _make_engine()