袁聪的第二次提交，项目已完整

app/api/controllers/conversations.py

@@ -3,21 +3,34 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.api.dependencies.auth import build_request_context
 from app.api.dependencies.database import get_session
-from app.api.schemas.conversations import FeedbackRequest, HandoverRequest
+from app.api.dependencies.rate_limit import enforce_rate_limit
+from app.api.schemas.conversations import FeedbackRequest
 from app.core.contracts import RequestContext
+from app.core.cursor import parse_cursor
 from app.service.conversation_service import ConversationService
 
-router = APIRouter(prefix="/api/v1", tags=["conversations"])
+router = APIRouter(prefix="/api/v1", tags=["conversations"],
+                   dependencies=[Depends(enforce_rate_limit)])
 
 
 @router.get("/conversations/{session_id}/messages")
 async def list_messages(
     session_id: str,
     limit: int = Query(default=20, ge=1, le=100),
+    cursor: str | None = Query(default=None),
     context: RequestContext = Depends(build_request_context),  # noqa: B008
     session: AsyncSession = Depends(get_session),  # noqa: B008
 ) -> dict[str, object]:
-    return await ConversationService(session).messages(session_id, context, limit)
+    """会话消息列表（文档 §7.3）。
+
+    `cursor` 是文档 §3.8 定义的游标，语义为"取更旧的一页"（记录 ID 边界）。
+    校验放在调用 Service 之前：非法游标必须在任何数据访问前变成
+    `400 INVALID_CURSOR`，而不是被静默忽略后返回第一页。
+    """
+    before = parse_cursor(cursor)
+    return await ConversationService(session).messages(
+        session_id, context, limit, before=before
+    )
 
 
 @router.post("/conversation-messages/{message_id}/feedback", status_code=status.HTTP_201_CREATED)
@@ -29,14 +42,3 @@ async def create_feedback(
 ) -> dict[str, object]:
     return await ConversationService(session).feedback(
         message_id, context, payload.rating, payload.feedback_type, payload.feedback_content)
-
-
-@router.post("/conversations/{session_id}/handover-requests", status_code=status.HTTP_202_ACCEPTED)
-async def request_handover(
-    session_id: str,
-    payload: HandoverRequest,
-    context: RequestContext = Depends(build_request_context),  # noqa: B008
-    session: AsyncSession = Depends(get_session),  # noqa: B008
-) -> dict[str, object]:
-    return await ConversationService(session).handover(
-        session_id, context, payload.reason_code, payload.reason_detail)