fix: TLS连接池复用 + 禁言检测 + 降级回复静默

- llm/openai.go: 移除DisableKeepAlives，启用连接池(100idle/20perhost/90s)
  修复频繁TLS握手超时问题
- qq/adapter.go: 监听group_ban通知，发送前检查禁言状态
  防止向被禁言群发消息导致风控
- cmd/main.go: 降级回复仅管理员私聊，群聊静默失败避免怪话
- protocol.go: OBv11Message新增Duration字段
- bridge/router.go: 处理noticeToUnified返回nil(内部消费的通知)

backend/ai-core/cmd/main.go

@@ -1221,11 +1221,16 @@ func handleChat(
 		IsAdmin:     req.IsAdmin,
 	})
 	if err != nil {
-		fallback := getFallbackMessage()
-		log.Printf("[chat] ProcessInput 失败，使用降级回复: %v", err)
-		fallbackData, _ := json.Marshal(map[string]string{"delta": fallback, "status": "fallback"})
-		fmt.Fprintf(w, "data: %s\n\n", fallbackData)
-		flusher.Flush()
+		// 降级回复：仅对管理员私聊发送，群聊/频道静默失败避免怪话
+		if req.IsAdmin && req.Source.ChannelType == "direct" {
+			fallback := getFallbackMessage()
+			log.Printf("[chat] ProcessInput 失败，发送降级回复: %v", err)
+			fallbackData, _ := json.Marshal(map[string]string{"delta": fallback, "status": "fallback"})
+			fmt.Fprintf(w, "data: %s\n\n", fallbackData)
+			flusher.Flush()
+		} else {
+			log.Printf("[chat] ProcessInput 失败，群聊静默: %v", err)
+		}
 		return
 	}
 
@@ -1250,11 +1255,14 @@ func handleChat(
 
 		case model.StreamError:
 			log.Printf("[chat] 流式错误: %v", event.Error)
-		fallback := getFallbackMessage()
-		log.Printf("[chat] 流式事件错误，发送降级回复: %v", event.Error)
-		fallbackData, _ := json.Marshal(map[string]string{"delta": fallback, "status": "fallback"})
-		fmt.Fprintf(w, "data: %s\n\n", fallbackData)
-			flusher.Flush()
+			// 降级回复：仅管理员私聊，群聊静默避免怪话
+			if req.IsAdmin && req.Source.ChannelType == "direct" {
+				fallback := getFallbackMessage()
+				log.Printf("[chat] 流式错误，发送降级回复: %v", event.Error)
+				fallbackData, _ := json.Marshal(map[string]string{"delta": fallback, "status": "fallback"})
+				fmt.Fprintf(w, "data: %s\n\n", fallbackData)
+				flusher.Flush()
+			}
 			return
 
 		case model.StreamDelta:

backend/ai-core/internal/llm/openai.go

@@ -41,9 +41,12 @@ func NewOpenAIProvider(cfg OpenAIConfig) *OpenAIProvider {
 		cfg.Timeout = 60 * time.Second
 	}
 
-	// 克隆默认 Transport 并关闭 keep-alive，防止 context 取消后连接池脏连接导致全阻塞
+	// 使用连接池复用 TCP+TLS 连接，避免每次请求都重新 TLS 握手
 	tr := http.DefaultTransport.(*http.Transport).Clone()
-	tr.DisableKeepAlives = true
+	tr.MaxIdleConns = 100
+	tr.MaxIdleConnsPerHost = 20
+	tr.IdleConnTimeout = 90 * time.Second
+	tr.TLSHandshakeTimeout = 15 * time.Second
 
 	return &OpenAIProvider{
 		config: cfg,