fix(whatsapp): block authentication templates for BSUID-only contacts - #15548

WhatsApp authentication templates require a phone-number recipient. Other template categories can be sent to a BSUID, but attempting an authentication template for a BSUID-only customer creates an invalid provider request and leaves the failure to Meta or Twilio.

This PR adds a shared server-side guard that identifies the selected template from provider-synced metadata and rejects the send before any provider request is made. The agent receives a clear failure explaining that authentication templates require a WhatsApp phone number.

What changed

• Detect BSUID recipients for both Meta Cloud and Twilio WhatsApp source-ID formats.
• Determine the template category from the provider-synced template definition rather than client-supplied parameters.
• Block authentication templates in direct Meta Cloud and Twilio WhatsApp sends.
• Apply the same protection to community and Enterprise one-off campaign paths.
• Leave phone-number recipients and non-authentication templates unchanged.

Things to know

• The blocked message or campaign recipient is marked failed locally; no request is submitted to Meta or Twilio.
• The guard depends on the synced template definition because that is the authoritative source for the template category.
• This PR is based on #15175. Once that PR is merged, this PR should be retargeted to develop.

How to test

1. Open a BSUID-only conversation in a Meta Cloud WhatsApp inbox.
2. Send an approved authentication template.
3. Confirm the message is marked failed with the phone-number requirement and no request reaches Meta.
4. Repeat from a Twilio WhatsApp inbox and confirm no request reaches Twilio.
5. Confirm a utility or marketing template can still be sent to the BSUID identity.
6. Confirm an authentication template can still be sent to a phone-number identity.

Fixes

Fixes https://linear.app/chatwoot/issue/CW-7805