Add production hardening: monitoring, backups, caching, and high-traffic resilience

- Recovery middleware (no more crash-on-panic), request metrics/monitoring
  store + admin API, in-memory TTL caching for read-heavy option/question/
  category lookups, gzip + rate-limiting middleware, sanitized chat message
  encoding, and pg_dump-based database backups with an admin API.
- Fix N+1 queries in the discover feed, candidate detail, and match list
  endpoints by batching selection/photo/user/last-message lookups into
  single queries instead of one-per-item loops.
- Tune DB connection pooling and add HTTP server timeouts + graceful
  shutdown so the API degrades gracefully instead of falling over under load.
- Fix a null (vs empty array) JSON response for candidates/matches without
  photos or interests, which crashed the web app's swipe card.

internal/repository/message_repository.go

@@ -33,3 +33,29 @@ func (r *MessageRepository) LastMessage(matchID uint) (*models.Message, error) {
 	}
 	return &msg, nil
 }
+
+// LastMessagesByMatchIDs آخرین پیام هر مچ رو، برای چند مچ با هم در یک کوئری
+// برمی‌گردونه (به‌جای یک کوئری جدا به‌ازای هر مچ توی لیست گفتگوها). از
+// DISTINCT ON پستگرس استفاده می‌کنه که دقیقاً برای همین کار («آخرین ردیف هر
+// گروه») ساخته شده.
+func (r *MessageRepository) LastMessagesByMatchIDs(matchIDs []uint) (map[uint]models.Message, error) {
+	result := make(map[uint]models.Message, len(matchIDs))
+	if len(matchIDs) == 0 {
+		return result, nil
+	}
+
+	var messages []models.Message
+	err := r.db.
+		Distinct("ON (match_id) *").
+		Where("match_id IN ?", matchIDs).
+		Order("match_id, created_at desc").
+		Find(&messages).Error
+	if err != nil {
+		return nil, err
+	}
+
+	for _, m := range messages {
+		result[m.MatchID] = m
+	}
+	return result, nil
+}