feat(message): add message encryption with batch decryption optimization

- Add encryption configuration with environment variable support
- Implement batch parallel decryption for improved query performance
- Integrate message encryptor via wire dependency injection
- Add explicit Decrypt() method for single message decryption
- Optimize AfterFind hook to defer decryption for batch processing

internal/model/message.go

@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"errors"
 	"strconv"
+	"sync"
 	"time"
 
 	"gorm.io/gorm"
@@ -198,8 +199,17 @@ func (m *Message) BeforeUpdate(tx *gorm.DB) error {
 	return nil
 }
 
-// AfterFind 查询后自动解密消息内容
+// AfterFind 查询后标记需要解密（实际解密延迟到批量处理时）
+// 这样可以支持批量并行解密优化
 func (m *Message) AfterFind(tx *gorm.DB) error {
+	// 标记为未解密状态，等待批量解密
+	// 如果是单条查询，AfterFind 后会立即使用，需要解密
+	m.decrypted = false
+	return nil
+}
+
+// Decrypt 解密单条消息（显式调用）
+func (m *Message) Decrypt() error {
 	return m.decryptSegments()
 }
 
@@ -310,3 +320,137 @@ func (m *Message) IsInteractionNotification() bool {
 		return false
 	}
 }
+
+// BatchDecryptMessages 批量并行解密消息
+// 用于批量查询后提高解密性能，比逐条调用 AfterFind 更高效
+// workerCount 指定并行工作数，如果 <= 0 则使用默认值
+func BatchDecryptMessages(messages []*Message, workerCount int) error {
+	if len(messages) == 0 {
+		return nil
+	}
+
+	encryptor := crypto.GetMessageEncryptor()
+	if encryptor == nil {
+		// 加密器未初始化，直接解析 JSON（兼容模式）
+		for _, m := range messages {
+			if m.decrypted || m.SegmentsEncrypted == "" {
+				m.decrypted = true
+				continue
+			}
+			if err := json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments); err != nil {
+				return err
+			}
+			m.decrypted = true
+		}
+		return nil
+	}
+
+	// 小批量直接串行处理
+	if len(messages) <= 10 {
+		for _, m := range messages {
+			if err := m.decryptSegments(); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	// 并行解密
+	// 先收集需要解密的密文
+	ciphertexts := make([]string, len(messages))
+	for i, m := range messages {
+		ciphertexts[i] = m.SegmentsEncrypted
+	}
+
+	// 批量并行解密
+	plaintexts := encryptor.BatchDecrypt(ciphertexts, workerCount)
+
+	// 解析结果
+	for i, m := range messages {
+		if m.decrypted {
+			continue
+		}
+		if m.SegmentsEncrypted == "" {
+			m.decrypted = true
+			continue
+		}
+
+		plaintext := plaintexts[i]
+		if plaintext == nil {
+			// 解密失败，尝试直接解析（兼容旧数据）
+			if err := json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments); err != nil {
+				continue // 忽略单条错误
+			}
+		} else {
+			if err := json.Unmarshal(plaintext, &m.Segments); err != nil {
+				continue // 忽略单条错误
+			}
+		}
+		m.decrypted = true
+	}
+
+	return nil
+}
+
+// BatchDecryptMessagesParallel 使用 worker pool 并行解密
+// 这是一个更高效的版本，适用于大量消息
+func BatchDecryptMessagesParallel(messages []*Message) {
+	if len(messages) == 0 {
+		return
+	}
+
+	encryptor := crypto.GetMessageEncryptor()
+	if encryptor == nil {
+		// 加密器未初始化，串行解析
+		for _, m := range messages {
+			if !m.decrypted && m.SegmentsEncrypted != "" {
+				_ = json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments)
+				m.decrypted = true
+			}
+		}
+		return
+	}
+
+	// 确定并行度
+	workerCount := 4
+	if len(messages) < 20 {
+		workerCount = 2
+	} else if len(messages) > 100 {
+		workerCount = 8
+	}
+
+	jobs := make(chan int, len(messages))
+	var wg sync.WaitGroup
+
+	// 启动 workers
+	for w := 0; w < workerCount; w++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			for i := range jobs {
+				m := messages[i]
+				if m.decrypted || m.SegmentsEncrypted == "" {
+					m.decrypted = true
+					continue
+				}
+
+				plaintext, err := encryptor.Decrypt(m.SegmentsEncrypted)
+				if err != nil {
+					// 尝试直接解析
+					_ = json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments)
+				} else {
+					_ = json.Unmarshal(plaintext, &m.Segments)
+				}
+				m.decrypted = true
+			}
+		}()
+	}
+
+	// 分发任务
+	for i := range messages {
+		jobs <- i
+	}
+	close(jobs)
+
+	wg.Wait()
+}