openclaw - 💡(How to fix) Fix [Bug]: Node exec approval replay fails with APPROVAL_CLIENT_MISMATCH for webchat (turnSourceTo null)

## Debug Trace

Added console.log before the APPROVAL_CLIENT_MISMATCH guard in server-methods-CxcGaVP0.js:

### Approval snapshot at guard:

{"snapshotDeviceId":null,"clientDeviceId":null,"requestedByConnId":"0d1c8e18-bd10-4465-85db-40632f41ab6f","clientConnId":"6354a36c-b0c3-4e7b-8a87-5ba64451c07d","requestedByDeviceTokenAuth":false,"requestedByClientId":"gateway-client","clientMode":"backend","turnSourceChannel":"webchat","rawTurnSourceChannel":"webchat"}

### Bridge function detailed output:

{"bridge2":false,"snapTo":null,"rawTo":null,"snapSession":"agent:main:main","rawSession":"agent:main:main","snapPlanSession":"agent:main:main","snapAgent":"main","rawAgent":"main","snapAccount":null,"rawAccount":null,"snapThread":null,"rawThread":null}

All fields match (channel, session, agent, account, thread) but bridge2=false because of turnSourceTo.

## Root Cause

canBridgeNoDeviceChatApprovalFromBackend() in server-methods-CxcGaVP0.js (~line 5836):

return matchesRequiredString({
    expected: request.turnSourceChannel,       // "webchat" ✓
    actual: params.rawParams.turnSourceChannel, // "webchat" ✓
    lowercase: true
}) && matchesRequiredString({
    expected: request.turnSourceTo,            // null ← PROBLEM HERE
    actual: params.rawParams.turnSourceTo      // null
}) && matchesRequiredString({
    expected: plan?.sessionKey ?? request.sessionKey,  // "agent:main:main" ✓
    actual: params.rawParams.sessionKey                // "agent:main:main" ✓
}) && matchesOptionalString({                  // ← correctly Optional
    expected: plan?.agentId ?? request.agentId,
    actual: params.rawParams.agentId
}) && matchesOptionalString({                  // ← correctly Optional
    expected: request.turnSourceAccountId,
    actual: params.rawParams.turnSourceAccountId
}) && matchesOptionalString({                  // ← correctly Optional
    expected: request.turnSourceThreadId,
    actual: params.rawParams.turnSourceThreadId
})

matchesRequiredString implementation:

function matchesRequiredString(params) {
    const expected = normalizeComparableString(params.expected, { lowercase: params.lowercase });
    if (!expected) return false;  // null/empty → instant false
    return expected === normalizeComparableString(params.actual, { lowercase: params.lowercase });
}

WebChat has no "to" recipient concept, so request.turnSourceTo is always null → matchesRequiredString returns false → entire bridge function returns false → APPROVAL_CLIENT_MISMATCH.

## Fix (verified locally)

Change matchesRequiredString to matchesOptionalString for the turnSourceTo field:

// Before (broken):
matchesRequiredString({ expected: request.turnSourceTo, actual: params.rawParams.turnSourceTo })

// After (fixed):
matchesOptionalString({ expected: request.turnSourceTo, actual: params.rawParams.turnSourceTo })

matchesOptionalString returns true when expected is null (field not applicable), which is the correct behavior for channels without a "to" target.

After applying this one-line patch, webchat node exec approval replay works correctly on multiple headless Linux nodes.