feat(gateway+web): D 消息编辑/删除 WS 实时广播 — message_edited/message_deleted

- 后端: ws_hub.go broadcastMessageEdited(完整DTO,thinking剥离)/broadcastMessageDeleted(全广播+sessionId,前端过滤); history_write.go PATCH/DELETE成功后触发(404/400/501不广播); history/message_ops.go GetMessage(导出壳,取删除前sessionId)
- 前端: useAppStore.updateMessageById/removeMessageById + messageEventApplies(同会话过滤); ws.ts 消费两事件(缺content丢弃); dispatchFrame导出(可测)
- 真机e2e: PATCH/DELETE → WS收到 message_edited/message_deleted, 二次删404无帧
- Docs/api-client v0.34 §3.8; 测试 history_write_broadcast_test + messageSync.test(14 checks)
- 遗留: 前端编辑/删除UI入口+api客户端函数未接(lib/api 无 PATCH/DELETE messages); ws_hub.go 589行>500(既有)

internal/services/gateway/history_write.go

@@ -1,6 +1,7 @@
 package gateway
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"net/http"
@@ -14,7 +15,9 @@ import (
 // This file owns the session/message write endpoints added for the Android
 // collaboration batch ③a: PATCH /sessions/{id} (A4 rename + D5 pin), PATCH
 // /messages/{id} (D3 edit) and DELETE /messages/{id} (D3 delete). All are owner/admin
-// history writes; the reads and DTOs live in history.go.
+// history writes; the reads and DTOs live in history.go. The D3 edit/delete paths also
+// broadcast their outcome over the WS hub (message_edited / message_deleted, see
+// ws_hub.go) so the account's other browsers stay in sync without a manual re-read.
 
 // patchSessionRequest is the PATCH /api/v1/sessions/{id} body. Both fields are pointers
 // so an absent field is distinguishable from an explicit zero value: title renames the
@@ -145,11 +148,20 @@ func (s *Server) handlePatchMessage(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to update message"))
 		return
 	}
+	// Broadcast the edit so every other browser of the account re-renders the same
+	// bubble without a refresh (the message_persisted realtime-sync contract, D3 edit
+	// path). Thinking is stripped from the frame to match the persisted/replay
+	// contract; the REST reply keeps it because the messages routes are owner/admin-only.
+	edited := toHistoryMessage(msg)
+	edited.Thinking = ""
+	s.hub.broadcastMessageEdited(edited)
 	writeJSON(w, http.StatusOK, toHistoryMessage(msg))
 }
 
 // handleDeleteMessage removes a single message (D3). An unknown id answers 404, a
-// missing HistoryStore 501. It is owner/admin-gated.
+// missing HistoryStore 501. It is owner/admin-gated. A successful delete is
+// broadcast as a `message_deleted` frame so every browser of the account drops the
+// row without a refresh; the owning session is read before the row disappears.
 func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
 	if s.history == nil {
 		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
@@ -160,6 +172,7 @@ func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
 		return
 	}
+	sessionID := s.messageSession(r.Context(), id)
 	if err := s.history.DeleteMessage(r.Context(), id); err != nil {
 		if errors.Is(err, history.ErrMessageNotFound) {
 			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
@@ -169,5 +182,31 @@ func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
 		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to delete message"))
 		return
 	}
+	s.hub.broadcastMessageDeleted(sessionID, id)
 	writeJSON(w, http.StatusOK, map[string]any{"deleted": id})
 }
+
+// messageLookup is the optional narrower view of HistoryStore used by DELETE to learn
+// a message's owning session before it is removed (afterwards there is nothing left to
+// ask). *history.Store implements it; a store that does not simply yields an unscoped
+// frame, which the client resolves by the globally unique message id.
+type messageLookup interface {
+	GetMessage(ctx context.Context, id string) (history.Message, error)
+}
+
+// messageSession returns the session id owning message id, or "" when the store cannot
+// answer (no lookup surface, unknown id, or a read error). A blank session is safe for
+// the broadcast: the message id is globally unique, so a client that falls back to an
+// id-only filter can only ever touch that message's own conversation.
+func (s *Server) messageSession(ctx context.Context, id string) string {
+	lookup, ok := s.history.(messageLookup)
+	if !ok {
+		return ""
+	}
+	msg, err := lookup.GetMessage(ctx, id)
+	if err != nil {
+		s.log.Debug("history message session lookup", "err", err, "message", id)
+		return ""
+	}
+	return msg.SessionID
+}