fix(deferred): close backend correctness/efficiency tails from the hygiene sweep

Verified each deferred per-subsystem item against current source, then fixed the
real ones (tradeoffs left as-is, see siftlode-ops/CODE-HYGIENE.md closeout):

- search BUG-3: don't finalise shorts_probed on un-enriched stubs (enrichment
  failure/omitted rows) — restores the scheduler's enriched_at guard so a real
  Short can't leak into the feed and never get reclassified.
- downloads GC: 4th pass reaps orphaned errored, fileless, unreferenced assets
  (they carry no TTL, so the expiry passes never cleared them).
- downloads B6: quota/edit errors now return a structured {code,reason,limit}
  the trilingual client localises, instead of hardcoded English + dot-decimal GB.
- channels BB1: reset-backfill re-arms deep sync on every subscriber (bulk update)
  instead of 404ing when the admin isn't personally subscribed.
- channels BB2: enrich the stub on BOTH the normal and "already exists" desync
  path (nest the insert try inside the client `with`).
- channels CB3: drop the redundant second _discovery_rows read (identity-mapped
  rows are already enriched; re-sort in Python for the title tie-break).
- playlists PC1: read the live playlist once in push() and share it with plan_push
  + push_playlist (halves read-quota, closes the second TOCTOU window).
- playlists PC2/PC5: batch the cover thumbnails in one window query (was N+1);
  rename combines count+duration into one aggregate + a single cover lookup.
- messages MB2: get_thread only resolves a messageable partner OR one we already
  share a thread with (closes the user-enumeration oracle).
- messages MB3: push a live unread-count to the user's other tabs after mark-read.
- messages MC4: list_conversations uses DISTINCT ON + grouped COUNT instead of
  loading the whole message history into memory.
- config AB3: per-spec allow_empty so smtp_user/youtube_api_proxy can be blanked
  to disable them rather than snapping back to the env default.

backend/app/routes/messages.py

@@ -17,7 +17,7 @@ from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, WebSocket, WebSocketDisconnect
 from pydantic import BaseModel
-from sqlalchemy import and_, func, or_, select
+from sqlalchemy import and_, case, func, or_, select
 from sqlalchemy.orm import Session
 
 from app.auth import require_human, resolved_user_id
@@ -220,25 +220,40 @@ def list_conversations(
     with the latest message + my unread count, newest first. Lazily creates the welcome on the
     first open. User-message previews are ciphertext — the client decrypts them."""
     ensure_welcome(db, user)
-    msgs = (
+    # The conversation partner for a message, from this user's perspective (system → 0).
+    partner_expr = case(
+        (Message.kind == "system", SYSTEM_PARTNER_ID),
+        (Message.sender_id == user.id, Message.recipient_id),
+        else_=Message.sender_id,
+    )
+    mine = or_(Message.sender_id == user.id, Message.recipient_id == user.id)
+    # Latest message per conversation in ONE query (DISTINCT ON, Postgres) instead of loading the
+    # user's whole message history into Python — bounded by the number of conversations.
+    latest = (
         db.execute(
             select(Message)
-            .where(or_(Message.sender_id == user.id, Message.recipient_id == user.id))
-            .order_by(Message.created_at.desc())
+            .where(mine)
+            .distinct(partner_expr)
+            .order_by(partner_expr, Message.created_at.desc())
         )
         .scalars()
         .all()
     )
-    convs: dict[int, dict] = {}
-    for m in msgs:
+    # Unread incoming, grouped per conversation.
+    unread = dict(
+        db.execute(
+            select(partner_expr, func.count())
+            .where(mine, Message.recipient_id == user.id, Message.read_at.is_(None))
+            .group_by(partner_expr)
+        ).all()
+    )
+
+    def _pid(m: Message) -> int:
         if m.kind == "system":
-            pid = SYSTEM_PARTNER_ID
-        else:
-            pid = m.recipient_id if m.sender_id == user.id else m.sender_id
-        c = convs.setdefault(pid, {"last": m, "unread": 0})
-        if m.recipient_id == user.id and m.read_at is None:
-            c["unread"] += 1
-    user_ids = [pid for pid in convs if pid != SYSTEM_PARTNER_ID]
+            return SYSTEM_PARTNER_ID
+        return m.recipient_id if m.sender_id == user.id else m.sender_id
+
+    user_ids = [_pid(m) for m in latest if m.kind != "system"]
     partners = {}
     if user_ids:
         partners = {
@@ -246,7 +261,8 @@ def list_conversations(
             for u in db.execute(select(User).where(User.id.in_(user_ids))).scalars().all()
         }
     items = []
-    for pid, c in convs.items():
+    for m in latest:
+        pid = _pid(m)
         if pid == SYSTEM_PARTNER_ID:
             partner = _system_partner()
         elif pid in partners:
@@ -254,7 +270,7 @@ def list_conversations(
         else:
             continue
         items.append(
-            {"partner": partner, "last_message": _serialize_msg(c["last"]), "unread": c["unread"]}
+            {"partner": partner, "last_message": _serialize_msg(m), "unread": int(unread.get(pid, 0))}
         )
     items.sort(key=lambda x: x["last_message"]["created_at"] or "", reverse=True)
     return {"items": items}
@@ -275,9 +291,6 @@ def get_thread(
         cond = and_(Message.recipient_id == user.id, Message.kind == "system")
     else:
         p = db.get(User, partner_id)
-        if p is None:
-            raise HTTPException(status_code=404, detail="User not found")
-        partner = _serialize_user(p)
         cond = and_(
             Message.kind == "user",
             or_(
@@ -285,6 +298,13 @@ def get_thread(
                 and_(Message.sender_id == partner_id, Message.recipient_id == user.id),
             ),
         )
+        # MB2: don't leak arbitrary user identities. Resolve a partner only if they're messageable
+        # OR we already share a thread (so a conversation with a since-suspended/deactivated user
+        # still opens). Otherwise the same 404 as a non-existent id → no enumeration oracle.
+        has_history = db.scalar(select(Message.id).where(cond).limit(1))
+        if p is None or (not is_messageable_user(p) and not has_history):
+            raise HTTPException(status_code=404, detail="User not found")
+        partner = _serialize_user(p)
     msgs = (
         db.execute(select(Message).where(cond).order_by(Message.created_at.asc()))
         .scalars()
@@ -299,6 +319,15 @@ def get_thread(
                 changed = True
         if changed:
             db.commit()
+            # MB3: tell this user's OTHER tabs/devices their unread dropped so the badge updates
+            # live instead of waiting for the next 20s poll. Carries the fresh total so the client
+            # needs no extra fetch.
+            n = db.scalar(
+                select(func.count())
+                .select_from(Message)
+                .where(Message.recipient_id == user.id, Message.read_at.is_(None))
+            )
+            manager.push(user.id, {"type": "unread", "count": int(n or 0)})
     return {"partner": partner, "items": [_serialize_msg(m) for m in msgs]}