Function build_keys_query_response 

pub fn build_keys_query_response(
    conn: &Connection,
    caller_user_id: i64,
    caller_mxid: &str,
    requested: &BTreeMap<String, Vec<String>>,
) -> Result<Value, MatrixError>

DB-only core for POST /keys/query (plan P9 brief): batch device_keys for every requested user this caller may see (self, or a shared-room peer — peers_sharing_a_room_with), plus master_keys/ self_signing_keys for the same allowed set, and user_signing_keys ONLY for the caller (spec: a user-signing key is never shared with anyone else). A requested user this caller may NOT see, or an mxid naming no known account, gets an empty device_keys entry ({}) rather than being omitted — the caller learns nothing about whether the account even exists.