refactor(ws): move verification checks from connection to per-operation level

Restructure verification enforcement to check at individual handler level (chat, recall, call invite) instead of during initial WebSocket connection. Add reusable isVerified helper method to reduce code duplication.

internal/handler/ws_handler.go

@@ -123,17 +123,6 @@ func (h *WSHandler) HandleWebSocket(c *gin.Context) {
 
 	userID := claims.UserID
 
-	// 检查用户认证状态
-	user, err := h.userRepo.GetByID(userID)
-	if err != nil {
-		response.InternalServerError(c, "获取用户信息失败")
-		return
-	}
-	if user.VerificationStatus != model.VerificationStatusApproved {
-		response.ErrorWithStringCode(c, http.StatusForbidden, "VERIFICATION_REQUIRED", "请先完成身份认证")
-		return
-	}
-
 	zap.L().Info("WebSocket connection attempt",
 		zap.String("user_id", userID),
 	)
@@ -351,6 +340,10 @@ func (h *WSHandler) handlePing(client *ws.Client) {
 
 // handleChat 处理聊天消息
 func (h *WSHandler) handleChat(ctx context.Context, client *ws.Client, payload json.RawMessage) {
+	if !h.isVerified(ctx, client) {
+		return
+	}
+
 	var req struct {
 		ConversationID string                `json:"conversation_id"`
 		DetailType     string                `json:"detail_type"`
@@ -457,6 +450,10 @@ func (h *WSHandler) handleRead(ctx context.Context, client *ws.Client, payload j
 
 // handleRecall 处理消息撤回
 func (h *WSHandler) handleRecall(ctx context.Context, client *ws.Client, payload json.RawMessage) {
+	if !h.isVerified(ctx, client) {
+		return
+	}
+
 	var req struct {
 		MessageID string `json:"message_id"`
 	}
@@ -493,10 +490,28 @@ func (h *WSHandler) handleRecall(ctx context.Context, client *ws.Client, payload
 
 const defaultUserBufferSize = 128
 
+// isVerified 检查用户是否已通过身份认证
+func (h *WSHandler) isVerified(ctx context.Context, client *ws.Client) bool {
+	user, err := h.userRepo.GetByID(client.UserID)
+	if err != nil {
+		h.wsHub.SendError(client, "internal_error", "获取用户信息失败")
+		return false
+	}
+	if user.VerificationStatus != model.VerificationStatusApproved {
+		h.wsHub.SendError(client, "VERIFICATION_REQUIRED", "请先完成身份认证")
+		return false
+	}
+	return true
+}
+
 // ==================== 通话信令处理 ====================
 
 // handleCallInvite 处理呼叫邀请
 func (h *WSHandler) handleCallInvite(ctx context.Context, client *ws.Client, payload json.RawMessage) {
+	if !h.isVerified(ctx, client) {
+		return
+	}
+
 	var req struct {
 		CalleeID       string `json:"callee_id"`
 		ConversationID string `json:"conversation_id"`