feat: 公共平台最小化打扰(design/12 §6)——5条策略: 分级+轻思考+限流+审查剔噪

降噪A(策略一/二/五):
- channelbridge/light.go: 非owner分级门——小事件当系统消息登记(不进loop)、非owner轻响应(她判断回/不回,规则优先mention/关键词+轻LLM兜底fail-closed静默)
- backthink 触发降噪: SubjectSystemEvent 低价值不唤醒thinking(仅高价值/owner才think), iot/reminder不受影响
- quiet hours: 安静时段非owner无信号静默,被@才回(非硬性静默); config QUIET_START/END_HOUR 单源共用

限流B(策略三/四):
- adapter/flowgate.go: per-adapter 滑窗限流器+总上限+审查剔噪闸门(Admit两连:速率+上限/审查), owner私聊绕过
- channelbridge/flowgate.go: onMessage入站最前挂闸, 超限/被剔不占worker槽; 审查模型NewLLMReviewer复用model.Adapter(仅>80%阈值触发+跨分钟节流,失败回退FIFO,绝不判身份)
- config: ChannelAccount 加 GroupMsgPerMin(默认6)/MsgPerMin/MaxMessages(默认50), CHANNELS_JSON每账号, 向后兼容
- 被剔消息走OnRejected审计不静默丢

main wire接线: 加modelAdapter字段+Review注入(reviewFor nil-safe,无LLM回退FIFO)
全仓 go build/vet/test 绿(53包)+交叉编译, 零新依赖, 前端无涉

internal/services/backthink/backthink.go

@@ -104,10 +104,14 @@ type Config struct {
 }
 
 // ConfigFromBackground maps a config.BackgroundConfig (the source of the
-// heartbeat interval) into a backthink.Config, leaving the push/decide knobs at
-// their defaults for normalize to fill in.
+// heartbeat interval and the shared quiet-hours window) into a backthink.Config,
+// leaving the push/decide knobs at their defaults for normalize to fill in.
 func ConfigFromBackground(bg config.BackgroundConfig) Config {
-	return Config{IntervalSec: bg.IntervalSec}
+	return Config{
+		IntervalSec:    bg.IntervalSec,
+		QuietStartHour: bg.QuietStartHour,
+		QuietEndHour:   bg.QuietEndHour,
+	}
 }
 
 // Deps is the injected dependency set for a Backthink. Only Thinker and DB are
@@ -308,12 +312,40 @@ func (b *Backthink) subscribe(ctx context.Context) {
 }
 
 // onEvent is the bus handler for event-triggered thinking. It runs on the bus's
-// own worker goroutine, so it must not block on another subscriber.
+// own worker goroutine, so it must not block on another subscriber. It first
+// applies the minimal-disturbance gate (design/12 §6 策略一): a low-value system
+// event is downgraded to a registration-only record rather than waking a full
+// thinking pass, so platform/system noise cannot flood the thinker.
 func (b *Backthink) onEvent(ctx context.Context, e bus.Event) error {
-	b.think(ctx, triggerForEvent(e))
+	tr := triggerForEvent(e)
+	if !b.shouldThink(tr) {
+		b.log.Debug("backthink system event downgraded, no thinking",
+			"source", tr.Source, "summary", tr.Summary)
+		b.record(Record{
+			Trigger:    tr.Source,
+			At:         b.now(),
+			Conclusion: "system event: low value, not worth waking a thinking pass",
+			ShouldPush: false,
+			PushResult: PushResult{Route: RouteNone, Detail: "downgraded"},
+		})
+		return nil
+	}
+	b.think(ctx, tr)
 	return nil
 }
 
+// shouldThink gates event-triggered thinking (design/12 §6 策略一). On a public
+// platform a generic system event is low value, so only a high-importance
+// (owner-relevant) system event wakes a pass. IoT device updates and reminder
+// triggers are owner-relevant / high value and are never gated, so the productive
+// triggers stay fully functional.
+func (b *Backthink) shouldThink(tr Trigger) bool {
+	if tr.Source == SubjectSystemEvent {
+		return tr.Import >= ImportanceHigh
+	}
+	return true
+}
+
 // tickLoop is the heartbeat goroutine. It fires one thinking pass per tick and
 // exits when ctx is cancelled.
 func (b *Backthink) tickLoop(ctx context.Context) {