refactor(server): decouple services and improve architecture

- Introduce interfaces for all major services (JWT, PostAI, Comment, Message, Notification, QRCodeLogin, Upload, Vote, etc.) to support dependency inversion.
- Move query parameters from `internal/dto` to a new `internal/query` package to separate request payloads from data transfer objects.
- Refactor `internal/router` to use embedded `RouterDeps` for cleaner dependency management.
- Decouple handlers from repositories by injecting services instead of direct repository access, ensuring proper layering.
- Improve database initialization by moving it from `internal/model` to `internal/database`.
- Optimize message decryption by implementing a more efficient `BatchDecrypt` method in `MessageEncryptor` using a worker pool.
- Enhance error handling and security by implementing fail-fast checks for encryption key length during startup.
- Clean up unused code, including the `avatar` package and several unused DTOs.

internal/wire/infrastructure_test.go

@@ -0,0 +1,91 @@
+package wire
+
+import (
+	"strings"
+	"testing"
+
+	"with_you/internal/config"
+	"with_you/internal/pkg/crypto"
+)
+
+// validTestKey 是用于测试的 32 字节 AES-256 密钥（仅测试用，不含敏感信息）。
+const validTestKey = "12345678901234567890123456789012"
+
+// TestProvideMessageEncryptor_Disabled 校验：加密关闭时应返回 nil 且不初始化加密器。
+func TestProvideMessageEncryptor_Disabled(t *testing.T) {
+	cfg := &config.Config{
+		Encryption: config.EncryptionConfig{
+			Enabled: false,
+			Key:     "",
+		},
+	}
+
+	err := ProvideMessageEncryptor(cfg)
+	if err != nil {
+		t.Fatalf("disabled encryption should return nil error, got: %v", err)
+	}
+}
+
+// TestProvideMessageEncryptor_EnabledBadKey 校验：加密启用但密钥非 32 字节时，
+// 必须 fail-fast 返回 error，且 error 信息提示长度问题。
+func TestProvideMessageEncryptor_EnabledBadKey(t *testing.T) {
+	cases := []struct {
+		name string
+		key  string
+	}{
+		{"empty", ""},
+		{"too_short", "shortkey"},
+		{"too_long", strings.Repeat("a", 64)},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := &config.Config{
+				Encryption: config.EncryptionConfig{
+					Enabled:    true,
+					Key:        tc.key,
+					KeyVersion: 1,
+				},
+			}
+
+			err := ProvideMessageEncryptor(cfg)
+			if err == nil {
+				t.Fatalf("enabled encryption with bad key (len=%d) must fail-fast, got nil", len(tc.key))
+			}
+			// 错误信息应包含 "32 bytes" 提示
+			if !strings.Contains(err.Error(), "32 bytes") {
+				t.Errorf("error should mention 32 bytes requirement, got: %v", err)
+			}
+		})
+	}
+}
+
+// TestProvideMessageEncryptor_EnabledValidKey 校验：加密启用且密钥合法时返回 nil，
+// 且加密器被正确初始化（GetKeyVersion 与配置一致）。
+// 注意：crypto 用 sync.Once 初始化，同一进程只生效一次。
+// 该用例必须最先在 fail-fast 用例之前运行以保证 Once 在合法状态下被消费；
+// 为避免测试顺序耦合，本用例独立 t.Run 顺序中放最后，并在合法 key 下幂等。
+func TestProvideMessageEncryptor_EnabledValidKey(t *testing.T) {
+	// 确保加密器在合法状态：直接以合法 key 初始化一次
+	if err := crypto.InitMessageEncryptor(validTestKey, 1); err != nil {
+		t.Fatalf("pre-init encryptor failed: %v", err)
+	}
+
+	cfg := &config.Config{
+		Encryption: config.EncryptionConfig{
+			Enabled:    true,
+			Key:        validTestKey,
+			KeyVersion: 1,
+		},
+	}
+
+	err := ProvideMessageEncryptor(cfg)
+	if err != nil {
+		t.Fatalf("valid encryption config should succeed, got: %v", err)
+	}
+
+	enc := crypto.GetMessageEncryptor()
+	if enc == nil {
+		t.Fatal("encryptor should be initialized after valid config")
+	}
+}