perf(chat): ingest a message batch in one transaction

Ingesting a scan's worth of chat messages persisted each new message
with its own append() call, so a batch of fresh messages opened and
committed one SQLite transaction per row.

- A new appendBatch persists many messages in a single transaction,
  using the same INSERT OR IGNORE dedup key as append() and preserving
  input order so load()'s rowid ordering is unchanged.
- Every message is serialized and encrypted before the transaction
  opens, so a message with a non-UTF-8 body is skipped on its own
  without leaving a transaction open; the valid siblings still persist.
- Ingest collects the newly stored messages and writes them once after
  the loop instead of per message. It is inert (returns 0) while locked
  or on empty input.

Tests cover a batch insert, dedup on re-insert, empty input, bad-UTF-8
isolation with a valid sibling and a following append(), insert order,
and the locked no-op.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/chat/chat_database.cpp

@@ -132,6 +132,55 @@ bool ChatDatabase::append(const ChatMessage& message)
     return sqlite3_changes(db_) > 0;
 }
 
+int ChatDatabase::appendBatch(const std::vector<ChatMessage>& messages)
+{
+    if (!key_ready_ || !ensureOpen()) return 0;
+    if (messages.empty()) return 0;
+
+    struct Row { std::string dedup; std::vector<unsigned char> nonce, cipher; };
+    std::vector<Row> rows;
+    rows.reserve(messages.size());
+    for (const auto& m : messages) {
+        if (isTombstoned(m)) continue;                 // locally deleted — don't re-persist
+        try {
+            std::string plain = serialize(m);          // strict json.dump() may throw on non-UTF-8 body
+            std::vector<unsigned char> nonce, cipher;
+            const bool ok = encrypt(plain, nonce, cipher);
+            if (!plain.empty()) sodium_memzero(&plain[0], plain.size());
+            if (!ok) continue;
+            rows.push_back({ dedupHash(m.txid, m.payload_position), std::move(nonce), std::move(cipher) });
+        } catch (const std::exception&) {
+            continue;                                  // skip only this message; never open a txn with bad data
+        }
+    }
+    if (rows.empty()) return 0;
+
+    if (!exec("BEGIN")) return 0;                      // match deleteMessages() in-file style
+    sqlite3_stmt* stmt = nullptr;
+    if (sqlite3_prepare_v2(db_,
+            "INSERT OR IGNORE INTO chat_messages (wallet_tag, dedup_hash, nonce, payload) "
+            "VALUES (?, ?, ?, ?)",
+            -1, &stmt, nullptr) != SQLITE_OK) {
+        exec("ROLLBACK");
+        return 0;
+    }
+    int inserted = 0;
+    bool ok = true;
+    for (const auto& r : rows) {
+        sqlite3_reset(stmt);
+        sqlite3_clear_bindings(stmt);
+        sqlite3_bind_text(stmt, 1, wallet_tag_.c_str(), -1, SQLITE_TRANSIENT);
+        sqlite3_bind_text(stmt, 2, r.dedup.c_str(), -1, SQLITE_TRANSIENT);
+        sqlite3_bind_blob(stmt, 3, r.nonce.data(), static_cast<int>(r.nonce.size()), SQLITE_TRANSIENT);
+        sqlite3_bind_blob(stmt, 4, r.cipher.data(), static_cast<int>(r.cipher.size()), SQLITE_TRANSIENT);
+        if (sqlite3_step(stmt) != SQLITE_DONE) { ok = false; break; }
+        if (sqlite3_changes(db_) > 0) ++inserted;
+    }
+    sqlite3_finalize(stmt);
+    if (!exec(ok ? "COMMIT" : "ROLLBACK")) return 0;
+    return ok ? inserted : 0;
+}
+
 bool ChatDatabase::upsert(const ChatMessage& message)
 {
     if (!key_ready_ || !ensureOpen()) return false;