fix(message): resolve Phase 5-6 audit findings

- Add missing version column to all message tables (migration + entities)
- Replace N+1 mark_all_read loop with single batch UPDATE query
- Fix NotificationList infinite re-render (extract queryFilter to stable ref)
- Fix NotificationPreferences dynamic import and remove unused Dayjs type
- Add Semaphore (max 8) to event listener for backpressure control
- Add /docs/openapi.json endpoint for API documentation
- Add permission check to unread_count handler
- Add version: Set(1) to all ActiveModel inserts

crates/erp-message/src/service/message_service.rs

@@ -1,6 +1,7 @@
 use chrono::Utc;
 use sea_orm::{
     ActiveModelTrait, ColumnTrait, EntityTrait, PaginatorTrait, QueryFilter, Set,
+    Statement, ConnectionTrait, DatabaseBackend,
 };
 use uuid::Uuid;
 
@@ -111,6 +112,7 @@ impl MessageService {
             created_by: Set(sender_id),
             updated_by: Set(sender_id),
             deleted_at: Set(None),
+            version: Set(1),
         };
 
         let inserted = model
@@ -172,6 +174,7 @@ impl MessageService {
             created_by: Set(system_user),
             updated_by: Set(system_user),
             deleted_at: Set(None),
+            version: Set(1),
         };
 
         let inserted = model
@@ -228,33 +231,26 @@ impl MessageService {
         Ok(())
     }
 
-    /// 标记所有消息已读。
+    /// 标记所有消息已读（批量 UPDATE，避免 N+1）。
     pub async fn mark_all_read(
         tenant_id: Uuid,
         user_id: Uuid,
         db: &sea_orm::DatabaseConnection,
     ) -> MessageResult<()> {
-        let unread = message::Entity::find()
-            .filter(message::Column::TenantId.eq(tenant_id))
-            .filter(message::Column::RecipientId.eq(user_id))
-            .filter(message::Column::IsRead.eq(false))
-            .filter(message::Column::DeletedAt.is_null())
-            .all(db)
-            .await
-            .map_err(|e| MessageError::Validation(e.to_string()))?;
-
         let now = Utc::now();
-        for m in unread {
-            let mut active: message::ActiveModel = m.into();
-            active.is_read = Set(true);
-            active.read_at = Set(Some(now));
-            active.updated_at = Set(now);
-            active.updated_by = Set(user_id);
-            active
-                .update(db)
-                .await
-                .map_err(|e| MessageError::Validation(e.to_string()))?;
-        }
+        db.execute(Statement::from_sql_and_values(
+            DatabaseBackend::Postgres,
+            "UPDATE messages SET is_read = true, read_at = $1, updated_at = $2, updated_by = $3 WHERE tenant_id = $4 AND recipient_id = $5 AND is_read = false AND deleted_at IS NULL",
+            [
+                now.into(),
+                now.into(),
+                user_id.into(),
+                tenant_id.into(),
+                user_id.into(),
+            ],
+        ))
+        .await
+        .map_err(|e| MessageError::Validation(e.to_string()))?;
 
         Ok(())
     }

crates/erp-message/src/service/subscription_service.rs

@@ -88,6 +88,7 @@ impl SubscriptionService {
                 created_by: Set(user_id),
                 updated_by: Set(user_id),
                 deleted_at: Set(None),
+                version: Set(1),
             };
 
             let inserted = model

crates/erp-message/src/service/template_service.rs

@@ -79,6 +79,7 @@ impl TemplateService {
             created_by: Set(operator_id),
             updated_by: Set(operator_id),
             deleted_at: Set(None),
+            version: Set(1),
         };
 
         let inserted = model