chore: temp switch to glm-4-flash for verification

fix: update model to GLM-4-Plus as requested

fix: set session.scope=global so chat reply sessionKey matches UI (fixes reply only working once)

fix: add allowedOrigins for HF Space; add scripts/openclaw.json.default for zhipu config