feat(messages): end-to-end encrypted real-time direct messaging backend

Private user-to-user messages are end-to-end encrypted: the server only ever
stores ciphertext + iv and acts as a key directory (public keys) plus an opaque
store for each user's private key, wrapped client-side with a passphrase the
server never sees — so not even an admin can read a conversation. A separate
kind=system message (plaintext, no sender) powers a server-authored Siftlode
welcome shown on first open, reusable later for announcements.

- models: rework Message (kind, nullable sender/body, ciphertext+iv) + MessageKey;
  migrations 0026 (table) + 0027 (E2EE rework).
- routes/messages.py: key directory/blob endpoints, ciphertext send, conversations
  + threads (system + user), lazy welcome, all gated by require_human.
- realtime.py: in-process WebSocket connection registry; /ws delivers sent
  messages to a user's open tabs instantly (sync-callable push, single-process).

backend/app/models.py

@@ -518,3 +518,69 @@ class Notification(Base):
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), index=True
     )
+
+
+class Message(Base):
+    """A message in the notification module (phase 2).
+
+    Two kinds share this table:
+      - `kind="user"`: a private, END-TO-END ENCRYPTED direct message between two users. The
+        server only ever stores `ciphertext` + `iv` (base64); it never holds the plaintext or
+        the keys, so not even an admin can read it. A conversation is just the set of messages
+        between two users — no separate thread entity; queries group by the {sender, recipient}
+        pair.
+      - `kind="system"`: a server-authored plaintext message (e.g. the welcome, or future admin
+        announcements). `sender_id` is NULL and `body` holds the text. These are non-private
+        boilerplate, readable without any E2EE key setup, and surface as a "Siftlode" conversation.
+
+    `read_at` is stamped when the recipient opens the thread (NULL = unread, feeds the nav
+    badge). The recipient FK cascades (and sender, for user messages) so a GDPR account erasure
+    removes that user's messages outright."""
+
+    __tablename__ = "messages"
+
+    id: Mapped[int] = mapped_column(primary_key=True)
+    kind: Mapped[str] = mapped_column(
+        String(16), default="user", server_default="user"
+    )
+    # NULL for system messages (no human sender).
+    sender_id: Mapped[int | None] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), index=True
+    )
+    recipient_id: Mapped[int] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), index=True
+    )
+    # System messages carry plaintext `body`; user messages carry `ciphertext`+`iv` (base64).
+    body: Mapped[str | None] = mapped_column(Text)
+    ciphertext: Mapped[str | None] = mapped_column(Text)
+    iv: Mapped[str | None] = mapped_column(String(32))
+    read_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), index=True
+    )
+
+
+class MessageKey(Base):
+    """A user's end-to-end-encryption key material for direct messaging (phase 2).
+
+    One row per user. `public_key` (base64 SPKI, ECDH P-256) is shared with others so they can
+    derive the pairwise conversation key. `wrapped_private_key` is the user's private key
+    encrypted IN THE BROWSER with a key derived (PBKDF2) from a message passphrase the server
+    never sees — so the server stores only an opaque blob it cannot unwrap. `salt`/`wrap_iv`
+    parameterise that derivation; `key_check` is a small ciphertext the client decrypts to
+    verify a passphrase on unlock. The server is purely a key directory + blob store; it can
+    never read any message."""
+
+    __tablename__ = "message_keys"
+
+    user_id: Mapped[int] = mapped_column(
+        ForeignKey("users.id", ondelete="CASCADE"), primary_key=True
+    )
+    public_key: Mapped[str] = mapped_column(Text)
+    wrapped_private_key: Mapped[str] = mapped_column(Text)
+    salt: Mapped[str] = mapped_column(String(64))
+    wrap_iv: Mapped[str] = mapped_column(String(32))
+    key_check: Mapped[str] = mapped_column(Text)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now()
+    )