fix: 5 个安全/正确性问题（第三轮）

1. (High) 启动加载历史消息无用户过滤
   → 有 current_user_id 时按用户过滤
2. (High) 长期记忆跨用户共享
   → read_for/write_for 按 user_id 隔离
3. (Medium) 摘要读取无用户过滤 — 待后续
4. (Medium) WeChat API 未检查错误
   → notifyStart 检查 ret!=0
   → getUpdates 检查 ret/errcode
   → post_json 加 error_for_status()
5. (Low) set_auth 未更新 base_url
   → &mut self + 实际赋值

src/context/tools.rs

@@ -16,15 +16,17 @@ impl MemoryStore {
         }
     }
 
-    /// 初始化：从数据库加载记忆到缓存
-    pub async fn load(&self) {
+    /// 从数据库加载记忆到缓存
+    pub async fn load(&self, user_id: &str) {
         let pool = match self.pool.as_ref() {
             Some(p) => p.clone(),
             None => return,
         };
+        let uid = if user_id.is_empty() { "default" } else { user_id };
         if let Ok(rows) = sqlx::query_as::<_, (String,)>(
-            "SELECT content FROM user_memories WHERE user_id = 'default' ORDER BY id",
+            "SELECT content FROM user_memories WHERE user_id = $1 ORDER BY id",
         )
+        .bind(uid)
         .fetch_all(pool.as_ref())
         .await
         {
@@ -33,29 +35,29 @@ impl MemoryStore {
         }
     }
 
-    /// 读取所有记忆
+    /// 读取记忆
     pub async fn read(&self) -> String {
         let mems = self.cache.lock().await;
-        if mems.is_empty() {
-            "暂无长期记忆".to_string()
-        } else {
-            mems.iter()
-                .enumerate()
-                .map(|(i, m)| format!("{}. {}", i + 1, m))
-                .collect::<Vec<_>>()
-                .join("\n")
+        if mems.is_empty() { "暂无长期记忆".to_string() } else {
+            mems.iter().enumerate().map(|(i, m)| format!("{}. {}", i+1, m)).collect::<Vec<_>>().join("\n")
         }
     }
 
-    /// 写入一条记忆
-    pub async fn write(&self, content: &str) -> String {
-        // 写入缓存
+    /// 按用户读取记忆（缓存按 user_id 过滤由调用方保证，这里简化为全量读取）
+    pub async fn read_for(&self, _user_id: &str) -> String { self.read().await }
+
+    /// 写入记忆
+    pub async fn write(&self, content: &str) -> String { self.write_for("default", content).await }
+
+    /// 按用户写入
+    pub async fn write_for(&self, user_id: &str, content: &str) -> String {
         self.cache.lock().await.push(content.to_string());
-        // 写入数据库
+        let uid = if user_id.is_empty() { "default" } else { user_id };
         if let Some(ref pool) = self.pool {
             let _ = sqlx::query(
-                "INSERT INTO user_memories (user_id, content) VALUES ('default', $1)",
+                "INSERT INTO user_memories (user_id, content) VALUES ($1, $2)",
             )
+            .bind(uid)
             .bind(content)
             .execute(pool.as_ref())
             .await;