fix(signal): normalize identifiers when matching DM allowlist

The DM allowlist check split sender_id on '|' and looked for raw membership
in the allow_from list. Senders carry their phone number with a leading
'+' but admins routinely write allowlist entries without it (or vice
versa), and UUID/ACI matches were case-sensitive. Both forms now flow
through _normalize_signal_id, so an entry like 19995550001 matches a
sender +19995550001 and a UUID matches case-insensitively.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/channels/test_signal_channel.py

@@ -510,6 +510,36 @@ class TestHandleDataMessageDM:
         await ch._handle_receive_notification(params)
         assert handled == []
 
+    @pytest.mark.asyncio
+    async def test_dm_allowlist_matches_without_plus_prefix(self):
+        """An allowlist entry without '+' must match a sender that carries '+'."""
+        ch, handled = self._make_dm_channel(policy="allowlist", allow_from=["19995550001"])
+        params = _dm_envelope(source_number="+19995550001")
+        await ch._handle_receive_notification(params)
+        assert len(handled) == 1
+
+    @pytest.mark.asyncio
+    async def test_dm_allowlist_matches_with_plus_prefix(self):
+        """An allowlist entry with '+' must match a sender without '+'."""
+        ch, handled = self._make_dm_channel(policy="allowlist", allow_from=["+19995550001"])
+        params = _dm_envelope(source_number="+19995550001", source_uuid=None)
+        # Replace envelope's sourceNumber with the non-prefixed form by editing
+        # the constructed dict directly so _collect_sender_id_parts sees it.
+        params["envelope"]["sourceNumber"] = "19995550001"
+        await ch._handle_receive_notification(params)
+        assert len(handled) == 1
+
+    @pytest.mark.asyncio
+    async def test_dm_allowlist_matches_uuid_case_insensitive(self):
+        """UUID matching must be case-insensitive."""
+        uuid = "ABCDEF12-3456-7890-ABCD-EF1234567890"
+        ch, handled = self._make_dm_channel(
+            policy="allowlist", allow_from=[uuid.lower()]
+        )
+        params = _dm_envelope(source_number="+19995550001", source_uuid=uuid)
+        await ch._handle_receive_notification(params)
+        assert len(handled) == 1
+
     @pytest.mark.asyncio
     async def test_dm_disabled_rejected(self):
         ch = _make_channel(dm_enabled=False)