feat(channels): 流控可配 —— 陌生人私聊额度走账号配置 directMsgPerMin（裁决 13）

- 后端：账号顶层 directMsgPerMin（缺失/0 = 保护性默认 6 条/分；正值 = 该值；负值 = 关闭并留带 source 的 WARN）
- 日志如实报出**实际生效**额度（adapter.(*FlowGate).DirectPerMin()），告警文案不再写死 6
- 面板：渠道配置表单加字段（含帮助文案）+ 回显/写回链路（LIMIT_KEYS 四键）+ 账号卡片摘要
- 文案纠错：AdapterConfigSummary 的 msgPerMin 由「私聊每分钟上限」改为「非主人消息每分钟总上限」（原描述是误导），并列补 directMsgPerMin 行
- 变异实测：缺键丢默认 / 负值当 1 条每分 / 前端吞负值 —— 三个都精确打红并还原
- ⚠️ 已知缺口（下一片补，gateway 面）：GET/PUT /admin/channels 尚未下发/解码该键 ⇒ 面板暂时回显空、保存会把 -1 重置为 0

internal/config/channels_test.go

@@ -57,7 +57,7 @@ func TestParseChannelAccounts_FlowLimitFields(t *testing.T) {
 	t.Parallel()
 	raw := `{
 		"telegram": [
-			{"id":"conf0","config":{"bot_token":"t0"},"groupMsgPerMin":10,"maxMessages":80,"msgPerMin":30}
+			{"id":"conf0","config":{"bot_token":"t0"},"groupMsgPerMin":10,"directMsgPerMin":-1,"maxMessages":80,"msgPerMin":30}
 		]
 	}`
 	got, err := ParseChannelAccounts(raw)
@@ -65,9 +65,11 @@ func TestParseChannelAccounts_FlowLimitFields(t *testing.T) {
 		t.Fatalf("ParseChannelAccounts: %v", err)
 	}
 	a := got["telegram"][0]
-	if a.GroupMsgPerMin != 10 || a.MsgPerMin != 30 || a.MaxMessages != 80 {
-		t.Fatalf("flow fields = group:%d msg:%d max:%d, want 10/30/80",
-			a.GroupMsgPerMin, a.MsgPerMin, a.MaxMessages)
+	// directMsgPerMin 是账号顶层字段（与 groupMsgPerMin 同一口径）：负值 = 关闭该限制，
+	// 必须是 -1，绝不能被解析层吞成 0（0 的语义是「用保护性默认 6」）。
+	if a.GroupMsgPerMin != 10 || a.MsgPerMin != 30 || a.MaxMessages != 80 || a.DirectMsgPerMin != -1 {
+		t.Fatalf("flow fields = group:%d direct:%d msg:%d max:%d, want 10/-1/30/80",
+			a.GroupMsgPerMin, a.DirectMsgPerMin, a.MsgPerMin, a.MaxMessages)
 	}
 }
 
@@ -80,8 +82,8 @@ func TestParseChannelAccounts_NoFlowFieldsDefaultsToZero(t *testing.T) {
 	}
 	a := got["telegram"][0]
 	// Absent fields stay zero; the bridge maps zero to the protective defaults
-	// (6 group/min, 50 max), so old accounts are backward compatible.
-	if a.GroupMsgPerMin != 0 || a.MsgPerMin != 0 || a.MaxMessages != 0 {
+	// (6 group/min, 6 direct/min, 50 max), so old accounts are backward compatible.
+	if a.GroupMsgPerMin != 0 || a.DirectMsgPerMin != 0 || a.MsgPerMin != 0 || a.MaxMessages != 0 {
 		t.Fatalf("absent flow fields should be zero, got %+v", a)
 	}
 }

internal/config/config.go

@@ -392,6 +392,12 @@ type ChannelAccount struct {
 	// (design/12 §6 策略三). Zero follows the protective default (6); a negative
 	// value disables the group rate limit; a positive value pins it.
 	GroupMsgPerMin int `json:"groupMsgPerMin,omitempty"`
+	// DirectMsgPerMin 是**非主人私聊（陌生人）每分钟每发送者上限**（主人 2026-10-05
+	// 裁决③与裁决 13「流控时间要可配置」；design/12 §6 策略三）。零值或未配置一律走
+	// 保护性默认 6 条/分（陌生人必须有流控，绝不允许因漏配静默敞口）；负值关闭该限制
+	// （主人的显式选择，桥会留一条带 source 的日志）；正值固定为该值。它随 channels.json
+	// 的**账号顶层**字段读写，与 GroupMsgPerMin 同一口径。
+	DirectMsgPerMin int `json:"directMsgPerMin,omitempty"`
 	// MsgPerMin caps total inbound non-owner messages per minute for this account.
 	// Zero or negative disables it.
 	MsgPerMin int `json:"msgPerMin,omitempty"`