fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/repositories/conversation_dispatch_queries.go

@@ -0,0 +1,17 @@
+package repositories
+
+import (
+	"agent-desk/internal/models"
+	"agent-desk/internal/pkg/enums"
+
+	"gorm.io/gorm"
+)
+
+// FindPendingDispatchBatch returns a bounded, checked page. A failed read must
+// not be mistaken for an empty queue by setup or the periodic dispatcher.
+func (r *conversationRepository) FindPendingDispatchBatch(db *gorm.DB, limit int) ([]models.Conversation, error) {
+	conversations := make([]models.Conversation, 0)
+	err := db.Where("status = ? AND current_assignee_id = ?", enums.IMConversationStatusPending, 0).
+		Order("id DESC").Limit(limit).Find(&conversations).Error
+	return conversations, err
+}