feat: add reply/forward/pin message flow across backend and web

- add reply_to/forwarded_from message fields and chat pinned_message field

- add forward and pin APIs plus reply support in message create

- wire web actions: Reply, Fwd, Pin and reply composer state

- fix spam policy bug: allow repeated identical messages, keep rate limiting

app/chats/service.py

@@ -4,7 +4,8 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.chats import repository
 from app.chats.models import Chat, ChatMember, ChatMemberRole, ChatType
-from app.chats.schemas import ChatCreateRequest, ChatTitleUpdateRequest
+from app.chats.schemas import ChatCreateRequest, ChatPinMessageRequest, ChatTitleUpdateRequest
+from app.messages.repository import get_message_by_id
 from app.users.repository import get_user_by_id
 
 
@@ -211,3 +212,28 @@ async def leave_chat_for_user(db: AsyncSession, *, chat_id: int, user_id: int) -
             )
     await repository.delete_chat_member(db, membership)
     await db.commit()
+
+
+async def pin_chat_message_for_user(
+    db: AsyncSession,
+    *,
+    chat_id: int,
+    user_id: int,
+    payload: ChatPinMessageRequest,
+) -> Chat:
+    chat, membership = await _get_chat_and_membership(db, chat_id=chat_id, user_id=user_id)
+    _ensure_group_or_channel(chat.type)
+    _ensure_manage_permission(membership.role)
+    if payload.message_id is None:
+        chat.pinned_message_id = None
+        await db.commit()
+        await db.refresh(chat)
+        return chat
+
+    message = await get_message_by_id(db, payload.message_id)
+    if not message or message.chat_id != chat_id:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Message not found in chat")
+    chat.pinned_message_id = message.id
+    await db.commit()
+    await db.refresh(chat)
+    return chat