feat(qq): post-merge hardening + docs for the QQ bot bridge

[chauncygu]

Follow-up to PR #121 (QQ bot bridge via qq-botpy).

Code hardening (bridges/qq.py):

• Image downloads moved off the async botpy event loop into loop.run_in_executor (new _qq_download_image_b64 helper). A synchronous urlopen in the on_message handler could block the event loop and its WebSocket heartbeat for up to 30s per image, risking a disconnect.
• cmd_qq now matches the cmd_slack / cmd_telegram secret-handling standard: $QQ_SECRET (recommended) > REPL arg (deprecated; warns + scrubs history)

  config. Env-supplied secrets are never persisted to config.json (the
  original PR wrote qq_secret to disk unconditionally). Adds /qq and /qq logout.

Docs:

• docs/guides/bridges.md: full QQ Bridge section (prerequisites, $QQ_SECRET setup, how-it-works, features, commands, auto-start); title + "all bridges" references updated.
• docs/guides/security.md: QQ_SECRET / QQ_APPID env-var rows; bot-token and denylist sections include QQ.
• .env.example: QQ_APPID / QQ_SECRET.
• CONTRIBUTING.md: QQ added to the Bridges note (async botpy WebSocket).
• README.md: QQ in the feature list, comparison table, and bridge tables; News trimmed to the latest 3 one-line entries (details in docs/news.md), with a new QQ release entry added to docs/news.md.