fix(xss+perf): SearchView XSS消除(无v-html)+room_id索引+pool_recycle

- SearchView.vue: 用 highlightSegments() 返回 {text,hit} 数组替代 v-html+escapeHtml+regex,模板用 <template v-for> + <mark>/<span> 渲染,从结构上消除 XSS 风险(4 处 v-html 全部移除: 消息片段/客户昵称/realName/手机号)
- models.py: Message 新增 ix_message_channel_owner_room_time(channel,owner_account_id,room_id,timestamp),群聊查询过滤 room_id 而非 talker_id,原 talker 索引无法覆盖
- migrations/d8eee96cd017: 新增 room_id 索引的 upgrade/downgrade (offline SQL 已验证)
- base.py + scheduler.py + cli.py: 所有生产 create_async_engine 增加 pool_recycle=3600,在 MySQL wait_timeout(默认 8h)断连前主动回收

Co-Authored-By: Claude <noreply@anthropic.com>

yunke-server/app/db/base.py

@@ -26,6 +26,7 @@ settings = get_settings()
 async_engine = create_async_engine(
     settings.db_url,
     pool_pre_ping=True,
+    pool_recycle=3600,  # recycle connections before MySQL wait_timeout (default 8h) closes them
     future=True,
 )
 

yunke-server/app/db/models.py

@@ -399,6 +399,17 @@ class Message(Base):
             "talker_id",
             "timestamp",
         ),
+        # Group-chat hot path: per-account, per-room, time-ordered pagination.
+        # Group messages filter on room_id (not talker_id, which is the *other
+        # party* in a DM); without this index MySQL scans the talker index then
+        # refilters on room_id, which on high-volume accounts degrades fast.
+        Index(
+            "ix_message_channel_owner_room_time",
+            "channel",
+            "owner_account_id",
+            "room_id",
+            "timestamp",
+        ),
     )
 
 

yunke-server/app/sync/cli.py

@@ -228,7 +228,12 @@ async def _init_db(db_url: str) -> tuple[Any, Any]:
     """
     from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
 
-    engine = create_async_engine(db_url, pool_pre_ping=True, future=True)
+    engine = create_async_engine(
+        db_url,
+        pool_pre_ping=True,
+        pool_recycle=3600,  # recycle before MySQL wait_timeout closes us
+        future=True,
+    )
     async with engine.begin() as conn:
         await conn.run_sync(Base.metadata.create_all)
     session_maker = async_sessionmaker(engine, expire_on_commit=False)

yunke-server/app/sync/scheduler.py

@@ -477,7 +477,10 @@ class SyncScheduler:
         else:
             settings = get_settings()
             self._engine = create_async_engine(
-                settings.db_url, pool_pre_ping=True, future=True
+                settings.db_url,
+                pool_pre_ping=True,
+                pool_recycle=3600,  # recycle before MySQL wait_timeout closes us
+                future=True,
             )
             self._session_maker = async_sessionmaker(
                 self._engine, expire_on_commit=False

yunke-server/migrations/versions/d8eee96cd017_add_room_id_index_for_group_chat_queries.py

@@ -0,0 +1,35 @@
+"""add room_id index for group chat queries
+
+Revision ID: d8eee96cd017
+Revises: e5f6a7b8c9d0
+Create Date: 2026-08-12 11:47:57.548178
+
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from alembic import op
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd8eee96cd017'
+down_revision: str | Sequence[str] | None = 'e5f6a7b8c9d0'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Upgrade schema."""
+    # Group-chat queries filter on room_id (not talker_id). Without this index
+    # MySQL falls back to scanning ix_message_channel_owner_talker_time and
+    # refiltering on room_id, which on high-volume accounts degrades fast.
+    op.create_index(
+        "ix_message_channel_owner_room_time",
+        "message",
+        ["channel", "owner_account_id", "room_id", "timestamp"],
+    )
+
+
+def downgrade() -> None:
+    """Downgrade schema."""
+    op.drop_index("ix_message_channel_owner_room_time", "message")