fix(wechat): recover expired sessions without silent stalls

[Ltcc0]

Summary

• classify expired/rejected iLink sessions and undecryptable credentials as requiring fresh WeChat authorization
• quarantine invalid connections without dropping queued outbound messages, and serialize delivery per connection
• forward a real first message after reconnect while consuming only the strict six-digit iLink handshake
• add rolling-deploy-compatible Supabase RPC migration, regression tests, and operational notes

Root cause

Matching completed and created outbound offers, but the WeChat worker could repeatedly retry an invalid encrypted credential or expired iLink session. The connection stayed active, so the user saw no reply and the outbox could produce a retry storm.

Validation

• pnpm test
• pnpm lint
• pnpm typecheck
• pnpm --filter @tomeet/data test (43 passed after final migration review)
• node scripts/migration-safety.mjs check --all
• pnpm exec supabase db push --linked --dry-run

Deployment order

1. Apply 20260726160000_quarantine_invalid_wechat_sessions.sql to the production Supabase project.
2. Deploy the API/WeChat worker from main using the same stable WECHAT_CREDENTIAL_ENCRYPTION_KEY.
3. Users whose old credentials cannot be decrypted or whose iLink session expired must scan a fresh QR code.