feat(history): 消息搜索/编辑/删除 + 会话置顶(D2/D3/D5)

- history/message_ops.go(新): Search(会话内, q/after互斥, LIKE参数化+%/_转义+大小写不敏感, 严格限定会话doc) / UpdateMessage(返回更新后Message) / DeleteMessage / messageByID / escapeLike
- history/session_pin.go(新): SetPinned; 迁移0009 chat_sessions加pinned INTEGER DEFAULT 0; store.go SessionMeta.Pinned + createSessionsTable加列
- session_preview.go: 查询加s.pinned + ORDER BY pinned DESC,(type=main) DESC,created_at ASC
- gateway history_write.go(新,保持history.go≤500): handlePatchSession(pinned+title) / handlePatchMessage / handleDeleteMessage; server.go加PATCH/DELETE /api/v1/messages/{id} + /sessions/{id}置顶
- history.go: handleListMessages读q分流Search; 契约PATCH title/置顶
- D2会话内搜索(不做跨会话,隔离会话不外泄红线); D3不做重发端点(客户端编辑后再发); D5用pinned bool
- 测试(message_ops/history_messages/migrate_pinned), build/vet/test绿+3平台交叉编译; Docs/api-client v0.30
- 未做: 编辑/删除WS实时广播(message_edited/deleted), 下批

internal/services/gateway/history_write.go

@@ -0,0 +1,173 @@
+package gateway
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"strings"
+	"unicode/utf8"
+
+	apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
+	"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
+)
+
+// This file owns the session/message write endpoints added for the Android
+// collaboration batch ③a: PATCH /sessions/{id} (A4 rename + D5 pin), PATCH
+// /messages/{id} (D3 edit) and DELETE /messages/{id} (D3 delete). All are owner/admin
+// history writes; the reads and DTOs live in history.go.
+
+// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. Both fields are pointers
+// so an absent field is distinguishable from an explicit zero value: title renames the
+// session (A4), pinned sets/unets the pin (D5), and at least one must be present.
+type patchSessionRequest struct {
+	Title  *string `json:"title"`
+	Pinned *bool   `json:"pinned"`
+}
+
+// maxSessionTitleRunes bounds a client-supplied session title so a display row never
+// overflows. It is a display-only bound: identity and permissions never derive from
+// the title (project red line).
+const maxSessionTitleRunes = 80
+
+// handlePatchSession updates a persistent session's display metadata: its title (A4)
+// and/or its pinned flag (D5). Both are display/order-only, so unlike DELETE they are
+// allowed on the fixed main session. A request carrying neither field answers 400, as
+// do an empty/whitespace or over-long title; an unknown session id answers 404. It is
+// owner/admin-gated like the other history writes. The response echoes only the fields
+// that were changed, so a title-only PATCH keeps its pre-D5 {id,title} shape.
+func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
+	if s.history == nil {
+		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
+		return
+	}
+	id := r.PathValue("id")
+	if id == "" {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "session id is required"))
+		return
+	}
+	var req patchSessionRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
+		return
+	}
+	if req.Title == nil && req.Pinned == nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title or pinned is required"))
+		return
+	}
+	resp := map[string]any{"id": id}
+	if req.Title != nil {
+		title := strings.TrimSpace(*req.Title)
+		if title == "" {
+			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is required"))
+			return
+		}
+		if utf8.RuneCountInString(title) > maxSessionTitleRunes {
+			writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is too long (max 80 characters)"))
+			return
+		}
+		if err := s.history.RenameSession(r.Context(), id, title); err != nil {
+			s.writeSessionPatchError(w, err, id, "rename session")
+			return
+		}
+		resp["title"] = title
+	}
+	if req.Pinned != nil {
+		if err := s.history.SetPinned(r.Context(), id, *req.Pinned); err != nil {
+			s.writeSessionPatchError(w, err, id, "pin session")
+			return
+		}
+		resp["pinned"] = *req.Pinned
+	}
+	writeJSON(w, http.StatusOK, resp)
+}
+
+// writeSessionPatchError maps a RenameSession/SetPinned failure to its response:
+// ErrSessionNotFound → 404, anything else → 500 (logged under op).
+func (s *Server) writeSessionPatchError(w http.ResponseWriter, err error, id, op string) {
+	if errors.Is(err, history.ErrSessionNotFound) {
+		writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "session %q not found", id))
+		return
+	}
+	s.log.Error(op, "err", err, "session", id)
+	writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to update session"))
+}
+
+// patchMessageRequest is the PATCH /api/v1/messages/{id} body. Content is a pointer so
+// an absent field is rejected rather than treated as an empty edit.
+type patchMessageRequest struct {
+	Content *string `json:"content"`
+}
+
+// maxMessageContentRunes bounds an edited message body. It is a storage/display bound
+// on the edit path only; inbound chat messages are not subject to it.
+const maxMessageContentRunes = 4000
+
+// handlePatchMessage edits a single message's content (Android collaboration batch ③a,
+// D3). Only content changes — role/timestamp/platform stay as stored — and the response
+// returns the updated message so the client can upsert it by id without a re-read. An
+// empty/whitespace or over-long content answers 400, an unknown id answers 404, and a
+// missing HistoryStore answers 501. It is owner/admin-gated.
+func (s *Server) handlePatchMessage(w http.ResponseWriter, r *http.Request) {
+	if s.history == nil {
+		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
+		return
+	}
+	id := r.PathValue("id")
+	if id == "" {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
+		return
+	}
+	var req patchMessageRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
+		return
+	}
+	if req.Content == nil {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
+		return
+	}
+	content := *req.Content
+	if strings.TrimSpace(content) == "" {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
+		return
+	}
+	if utf8.RuneCountInString(content) > maxMessageContentRunes {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is too long (max 4000 characters)"))
+		return
+	}
+	msg, err := s.history.UpdateMessage(r.Context(), id, content)
+	if err != nil {
+		if errors.Is(err, history.ErrMessageNotFound) {
+			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
+			return
+		}
+		s.log.Error("history update message", "err", err, "message", id)
+		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to update message"))
+		return
+	}
+	writeJSON(w, http.StatusOK, toHistoryMessage(msg))
+}
+
+// handleDeleteMessage removes a single message (D3). An unknown id answers 404, a
+// missing HistoryStore 501. It is owner/admin-gated.
+func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
+	if s.history == nil {
+		writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
+		return
+	}
+	id := r.PathValue("id")
+	if id == "" {
+		writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
+		return
+	}
+	if err := s.history.DeleteMessage(r.Context(), id); err != nil {
+		if errors.Is(err, history.ErrMessageNotFound) {
+			writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
+			return
+		}
+		s.log.Error("history delete message", "err", err, "message", id)
+		writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to delete message"))
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"deleted": id})
+}