Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/mailfetch/fetch_test.go

@@ -0,0 +1,40 @@
+package mailfetch
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"testing"
+
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
+)
+
+func TestGmailIDPrefersXGMMsgID(t *testing.T) {
+	if got := gmailID(FetchResult{UID: 7, GmailMsgID: "555"}, 42); got != "555" {
+		t.Errorf("gmailID() = %q, want 555", got)
+	}
+}
+
+func TestGmailIDFallbackIsScopedToUIDValidity(t *testing.T) {
+	if got := gmailID(FetchResult{UID: 7}, 42); got != "uid:42:7" {
+		t.Errorf("gmailID() = %q, want uid:42:7", got)
+	}
+}
+
+func TestJoinKeys(t *testing.T) {
+	if got := joinKeys(map[string]struct{}{}); got != "none" {
+		t.Errorf("joinKeys(empty) = %q, want none", got)
+	}
+	got := joinKeys(map[string]struct{}{"To": {}, "X-Pm-Original-To": {}})
+	if got != "To,X-Pm-Original-To" {
+		t.Errorf("joinKeys() = %q, want sorted keys", got)
+	}
+}
+
+func TestFetchWithoutCredentials(t *testing.T) {
+	cfg := &config.Config{Env: "test", IMAPHost: config.DefaultIMAPHost, IMAPPort: config.DefaultIMAPPort}
+	f := NewFetcher(cfg, nil, slog.New(slog.DiscardHandler))
+	if _, err := f.Fetch(context.Background()); !errors.Is(err, ErrNoCredentials) {
+		t.Fatalf("Fetch() error = %v, want ErrNoCredentials", err)
+	}
+}