feat(messages): end-to-end encrypted real-time direct messaging backend

Private user-to-user messages are end-to-end encrypted: the server only ever
stores ciphertext + iv and acts as a key directory (public keys) plus an opaque
store for each user's private key, wrapped client-side with a passphrase the
server never sees — so not even an admin can read a conversation. A separate
kind=system message (plaintext, no sender) powers a server-authored Siftlode
welcome shown on first open, reusable later for announcements.

- models: rework Message (kind, nullable sender/body, ciphertext+iv) + MessageKey;
  migrations 0026 (table) + 0027 (E2EE rework).
- routes/messages.py: key directory/blob endpoints, ciphertext send, conversations
  + threads (system + user), lazy welcome, all gated by require_human.
- realtime.py: in-process WebSocket connection registry; /ws delivers sent
  messages to a user's open tabs instantly (sync-callable push, single-process).

backend/app/realtime.py

@@ -0,0 +1,60 @@
+"""In-process WebSocket connection registry for live server→client push.
+
+Generic groundwork (notification module phase 2 is the first user): connections are kept in
+this process's memory, keyed by user_id, so a request handler can push an event to all of a
+user's open tabs/devices. Single-uvicorn-process assumption — if we ever run multiple workers,
+replace the in-memory map with a Redis pub/sub fan-out behind the same `push()` interface (same
+note as app.ratelimit).
+
+`push()` is intentionally SYNC-callable: ordinary (sync) route handlers run in a threadpool, so
+they schedule the actual send onto the WebSocket event loop via run_coroutine_threadsafe. The
+connect/disconnect/_push coroutines all run on that one loop, so the connection map is only ever
+mutated from a single thread.
+"""
+import asyncio
+import logging
+from collections import defaultdict
+
+from starlette.websockets import WebSocket
+
+log = logging.getLogger("siftlode.realtime")
+
+
+class ConnectionManager:
+    def __init__(self) -> None:
+        self._conns: dict[int, set[WebSocket]] = defaultdict(set)
+        self._loop: asyncio.AbstractEventLoop | None = None
+
+    async def connect(self, user_id: int, ws: WebSocket) -> None:
+        self._loop = asyncio.get_running_loop()
+        await ws.accept()
+        self._conns[user_id].add(ws)
+
+    async def disconnect(self, user_id: int, ws: WebSocket) -> None:
+        conns = self._conns.get(user_id)
+        if conns:
+            conns.discard(ws)
+            if not conns:
+                self._conns.pop(user_id, None)
+
+    async def _push(self, user_id: int, payload: dict) -> None:
+        for ws in list(self._conns.get(user_id, ())):
+            try:
+                await ws.send_json(payload)
+            except Exception:
+                # Stale socket; it'll be cleaned up by its own disconnect handler.
+                pass
+
+    def push(self, user_id: int, payload: dict) -> None:
+        """Schedule a push onto the WebSocket event loop. Safe to call from a sync route
+        handler (threadpool). No-op if no WebSocket has ever connected (no loop captured)."""
+        loop = self._loop
+        if loop is None:
+            return
+        try:
+            asyncio.run_coroutine_threadsafe(self._push(user_id, payload), loop)
+        except Exception:
+            log.debug("ws push failed", exc_info=True)
+
+
+manager = ConnectionManager()