Fix auth bypass: every user was authorized

_check_auth() tested the truthiness of the ConfigField descriptor object
instead of its value. ConfigField defines no __get__, so the attribute
access returned the descriptor itself — always truthy — and the function
returned True for every user, ignoring allowed_users entirely.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

adapter.py

@@ -370,12 +370,13 @@ class ChattoAdapter(BasePlatformAdapter):
         """We roll our own auth-systen on the against the chatto_config'ured allowed_users etc.
            because.. Hermes authz_mixin.py IS NOT SANE.
         """
-        if self.chatto_config.allow_all_users:
+        if self.chatto_config.allow_all_users.value:
             return True
         if user.login in self.chatto_config.allowed_users.value:
             return True
         if user.id in self.chatto_config.allowed_users.value:
             return True
+        logger.info("Chatto: rejecting message from unauthorized user '%s' (%s)", user.login, user.id)
         return False
 
     async def _dispatch_message_posted(self, payload: MessagePostedPayload) -> None: