Stage 36 — Mark Message Read API
POST /api/v1/messages/read.php
Authorization: Bearer <token>
JSON body: {"message_id": 1}
Marks the authenticated recipient's read flag only when the message belongs to that recipient.
No schema changes.
