refactor(server): decouple services and improve architecture

- Introduce interfaces for all major services (JWT, PostAI, Comment, Message, Notification, QRCodeLogin, Upload, Vote, etc.) to support dependency inversion.
- Move query parameters from `internal/dto` to a new `internal/query` package to separate request payloads from data transfer objects.
- Refactor `internal/router` to use embedded `RouterDeps` for cleaner dependency management.
- Decouple handlers from repositories by injecting services instead of direct repository access, ensuring proper layering.
- Improve database initialization by moving it from `internal/model` to `internal/database`.
- Optimize message decryption by implementing a more efficient `BatchDecrypt` method in `MessageEncryptor` using a worker pool.
- Enhance error handling and security by implementing fail-fast checks for encryption key length during startup.
- Clean up unused code, including the `avatar` package and several unused DTOs.

internal/model/message.go

@@ -1,9 +1,8 @@
-package model
+package model
 
 import (
 	"database/sql/driver"
 	"encoding/json"
-	"sync"
 	"time"
 
 	"gorm.io/gorm"
@@ -303,9 +302,14 @@ func (m *Message) IsInteractionNotification() bool {
 	}
 }
 
-
-// BatchDecryptMessagesParallel 使用 worker pool 并行解密
-// 这是一个更高效的版本，适用于大量消息
+// BatchDecryptMessagesParallel 批量解密消息段。
+// 并发逻辑收敛在 crypto.MessageEncryptor.BatchDecrypt（worker pool），
+// 本函数仅负责「提取密文 → 回填明文到 Message.Segments」，不再自起 goroutine。
+//
+// 行为保持与历史版本一致：
+//   - 加密器未初始化时，降级为明文 JSON 直接解析（兼容旧数据）；
+//   - 单条解密失败时回退尝试直接 JSON 解析（兼容未加密旧数据）；
+//   - 已解密或无加密内容的消息跳过。
 func BatchDecryptMessagesParallel(messages []*Message) {
 	if len(messages) == 0 {
 		return
@@ -313,7 +317,7 @@ func BatchDecryptMessagesParallel(messages []*Message) {
 
 	encryptor := crypto.GetMessageEncryptor()
 	if encryptor == nil {
-		// 加密器未初始化，串行解析
+		// 加密器未初始化，串行解析为明文 JSON（兼容模式）
 		for _, m := range messages {
 			if !m.decrypted && m.SegmentsEncrypted != "" {
 				_ = json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments)
@@ -323,46 +327,34 @@ func BatchDecryptMessagesParallel(messages []*Message) {
 		return
 	}
 
-	// 确定并行度
-	workerCount := 4
-	if len(messages) < 20 {
-		workerCount = 2
-	} else if len(messages) > 100 {
-		workerCount = 8
+	// 提取待解密的密文索引与值
+	indices := make([]int, 0, len(messages))
+	ciphertexts := make([]string, 0, len(messages))
+	for i, m := range messages {
+		if m.decrypted || m.SegmentsEncrypted == "" {
+			m.decrypted = true
+			continue
+		}
+		indices = append(indices, i)
+		ciphertexts = append(ciphertexts, m.SegmentsEncrypted)
+	}
+	if len(ciphertexts) == 0 {
+		return
 	}
 
-	jobs := make(chan int, len(messages))
-	var wg sync.WaitGroup
+	// 并发解密（worker pool 由 crypto.BatchDecrypt 内部管理）
+	plaintexts := encryptor.BatchDecrypt(ciphertexts, 0)
 
-	// 启动 workers
-	for w := 0; w < workerCount; w++ {
-		wg.Add(1)
-		go func() {
-			defer wg.Done()
-			for i := range jobs {
-				m := messages[i]
-				if m.decrypted || m.SegmentsEncrypted == "" {
-					m.decrypted = true
-					continue
-				}
-
-				plaintext, err := encryptor.Decrypt(m.SegmentsEncrypted)
-				if err != nil {
-					// 尝试直接解析
-					_ = json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments)
-				} else {
-					_ = json.Unmarshal(plaintext, &m.Segments)
-				}
-				m.decrypted = true
-			}
-		}()
+	// 回填明文；解密失败的位置回退直接 JSON 解析
+	for j, idx := range indices {
+		m := messages[idx]
+		pt := plaintexts[j]
+		if pt == nil {
+			// 解密失败，兼容未加密的旧数据
+			_ = json.Unmarshal([]byte(m.SegmentsEncrypted), &m.Segments)
+		} else {
+			_ = json.Unmarshal(pt, &m.Segments)
+		}
+		m.decrypted = true
 	}
-
-	// 分发任务
-	for i := range messages {
-		jobs <- i
-	}
-	close(jobs)
-
-	wg.Wait()
 }