Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.env.example

@@ -21,11 +21,18 @@ EMAIL_AGENT_SESSION_SECRET=change-me
 # doubles as the password.
 EMAIL_AGENT_PASSWORD=
 
+# --- Gmail IMAP (Phase 2) ---------------------------------------------------
+# App password only (AGENTS.md §9). Values live in the host environment, never here.
+GMAIL_USER=
+GMAIL_APP_PASSWORD=
+EMAIL_AGENT_IMAP_HOST=imap.gmail.com
+EMAIL_AGENT_IMAP_PORT=993
+EMAIL_AGENT_IMAP_LOOKBACK_DAYS=14
+EMAIL_AGENT_IMAP_MAX_MESSAGES=100
+
 # --- Integrations (used from later phases) ---------------------------------
 JEV_BASE_URL=
 JEV_API_KEY=
 OMNIROUTE_BASE_URL=
 OMNIROUTE_API_KEY=
-EMAIL_AGENT_GMAIL_CREDENTIALS_FILE=
-EMAIL_AGENT_GMAIL_TOKEN_FILE=
 HUB_TOKEN=