feat：对接中心平台，完善接口鉴权

app/services/conversation_mongo.py

@@ -42,6 +42,8 @@ class MongoConversationStore:
         )
         # 空会话清理按创建时间扫描
         await self._conversations.create_index("created_at")
+        # 按用户查询会话
+        await self._conversations.create_index("user_id")
 
     async def _purge_expired(self) -> None:
         # 只清理没有任何轮次且超过保留时长的空会话，有对话的会话不受影响
@@ -63,17 +65,20 @@ class MongoConversationStore:
         if empty:
             await self._conversations.delete_many({"_id": {"$in": empty}})
 
-    async def create(self) -> str:
+    async def create(self, user_id: int) -> str:
         await self._purge_expired()
         conversation_id = str(uuid4())
-        # user_id 为后续长期记忆预留，当前恒为空
+        # user_id 来自用户中心，会话只对创建者可见
         await self._conversations.insert_one(
-            {"_id": conversation_id, "created_at": _now(), "user_id": None}
+            {"_id": conversation_id, "created_at": _now(), "user_id": user_id}
         )
         return conversation_id
 
-    async def exists(self, conversation_id: str) -> bool:
-        document = await self._conversations.find_one({"_id": conversation_id})
+    async def exists(self, conversation_id: str, user_id: int) -> bool:
+        # 不属于该用户的会话与不存在同样处理，不泄露会话是否存在
+        document = await self._conversations.find_one(
+            {"_id": conversation_id, "user_id": user_id}
+        )
         if document is None:
             return False
         if document["created_at"] >= _now() - self._empty_ttl: