feat: 公共平台最小化打扰(design/12 §6)——5条策略: 分级+轻思考+限流+审查剔噪

降噪A(策略一/二/五):
- channelbridge/light.go: 非owner分级门——小事件当系统消息登记(不进loop)、非owner轻响应(她判断回/不回,规则优先mention/关键词+轻LLM兜底fail-closed静默)
- backthink 触发降噪: SubjectSystemEvent 低价值不唤醒thinking(仅高价值/owner才think), iot/reminder不受影响
- quiet hours: 安静时段非owner无信号静默,被@才回(非硬性静默); config QUIET_START/END_HOUR 单源共用

限流B(策略三/四):
- adapter/flowgate.go: per-adapter 滑窗限流器+总上限+审查剔噪闸门(Admit两连:速率+上限/审查), owner私聊绕过
- channelbridge/flowgate.go: onMessage入站最前挂闸, 超限/被剔不占worker槽; 审查模型NewLLMReviewer复用model.Adapter(仅>80%阈值触发+跨分钟节流,失败回退FIFO,绝不判身份)
- config: ChannelAccount 加 GroupMsgPerMin(默认6)/MsgPerMin/MaxMessages(默认50), CHANNELS_JSON每账号, 向后兼容
- 被剔消息走OnRejected审计不静默丢

main wire接线: 加modelAdapter字段+Review注入(reviewFor nil-safe,无LLM回退FIFO)
全仓 go build/vet/test 绿(53包)+交叉编译, 零新依赖, 前端无涉

internal/config/config.go

@@ -104,11 +104,17 @@ type VoiceConfig struct {
 	DashscopeAPIKey string `env:"DASHSCOPE_API_KEY"`
 }
 
-// BackgroundConfig holds the autonomous thinking settings.
+// BackgroundConfig holds the autonomous thinking settings. QuietStartHour and
+// QuietEndHour bound the do-not-disturb window in local clock hours; they are the
+// single source shared by the backthink service and the channel bridge's
+// minimal-disturbance quiet-hours gate (design/12 §6 策略五). Equal non-zero hours
+// disable the window.
 type BackgroundConfig struct {
 	Enabled        bool `env:"ENABLE_BACKGROUND_THINKING" default:"true"`
 	IntervalSec    int  `env:"THINK_INTERVAL_SEC" default:"300"`
 	SilenceTimeout int  `env:"THINK_SILENCE_TIMEOUT_SEC" default:"120"`
+	QuietStartHour int  `env:"QUIET_START_HOUR" default:"23"`
+	QuietEndHour   int  `env:"QUIET_END_HOUR" default:"7"`
 }
 
 // WSHubConfig holds the WebSocket hub limits.
@@ -193,6 +199,18 @@ type ChannelAccount struct {
 	// DenyUsers is a black list of user uids: a direct message from a user in this
 	// list is dropped at ingress.
 	DenyUsers []string `json:"denyUsers,omitempty"`
+	// GroupMsgPerMin caps group-chat inbound messages per minute for this account
+	// (design/12 §6 策略三). Zero follows the protective default (6); a negative
+	// value disables the group rate limit; a positive value pins it.
+	GroupMsgPerMin int `json:"groupMsgPerMin,omitempty"`
+	// MsgPerMin caps total inbound non-owner messages per minute for this account.
+	// Zero or negative disables it.
+	MsgPerMin int `json:"msgPerMin,omitempty"`
+	// MaxMessages is the total pending/active message cap for this account
+	// (design/12 §6 策略四). Zero follows the protective default (50); a negative
+	// value disables the cap; a positive value pins it. When the pending set nears
+	// this cap the review model prunes low-value messages.
+	MaxMessages int `json:"maxMessages,omitempty"`
 }
 
 // Load reads configuration, merging an optional .env file (development only)