Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/server/auth.go

@@ -213,6 +213,7 @@ func (s *Server) handleLogout(w http.ResponseWriter, r *http.Request) {
 type navItem struct {
 	Name  string
 	Color string
+	Count int
 }
 
 type dashboardData struct {
@@ -220,27 +221,40 @@ type dashboardData struct {
 	User       string
 	CSRFToken  string
 	Version    string
+	Total      int
 	Categories []navItem
 	Folders    []navItem
 }
 
-// handleDashboard renders the empty inbox shell.
+// handleDashboard renders the inbox shell with real category counts.
 func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	sess := sessionFrom(r)
+
+	// FR-5: counts come from the stored messages. Phase 2 has no classifier
+	// yet, so every message lands under Unclassified (AGENTS.md §13.2).
+	items, err := s.store.ListMessages(r.Context(), 200)
+	if err != nil {
+		s.logger.Error("load dashboard counts", "error", err)
+		items = nil
+	}
+	counts := categoryCounts(items)
+
 	data := dashboardData{
 		Greeting:  partOfDay(time.Now()),
 		User:      sess.User,
 		CSRFToken: s.csrfToken(w, r),
 		Version:   version.Version,
+		Total:     len(items),
 		// Placeholders until FR-14 (editable categories) and FR-9 (folders)
 		// land. Colours are the design system's decorative sticker palette.
 		Categories: []navItem{
-			{Name: "Action", Color: "var(--primary)"},
-			{Name: "Important", Color: "var(--sticker-orange)"},
-			{Name: "Info", Color: "var(--sticker-sky)"},
-			{Name: "Spam", Color: "var(--sticker-red)"},
-			{Name: "Newsletter", Color: "var(--sticker-purple)"},
-			{Name: "Auto-reply", Color: "var(--sticker-teal)"},
+			{Name: "Action", Color: "var(--primary)", Count: counts["action"]},
+			{Name: "Important", Color: "var(--sticker-orange)", Count: counts["important"]},
+			{Name: "Info", Color: "var(--sticker-sky)", Count: counts["info"]},
+			{Name: "Spam", Color: "var(--sticker-red)", Count: counts["spam"]},
+			{Name: "Newsletter", Color: "var(--sticker-purple)", Count: counts["newsletter"]},
+			{Name: "Auto-reply", Color: "var(--sticker-teal)", Count: counts["auto-reply"]},
+			{Name: "Unclassified", Color: "var(--ink-faint)", Count: counts[unclassifiedCategory]},
 		},
 		Folders: []navItem{
 			{Name: "Replied-to", Color: "var(--sticker-green)"},
@@ -254,15 +268,6 @@ func (s *Server) handleDashboard(w http.ResponseWriter, r *http.Request) {
 	}
 }
 
-// handleInboxPartial is the HTMX fragment for the centre list. Phase 1.2 has no
-// mail yet, so it renders the empty state.
-func (s *Server) handleInboxPartial(w http.ResponseWriter, r *http.Request) {
-	w.Header().Set("Content-Type", "text/html; charset=utf-8")
-	if err := s.tmpl.ExecuteTemplate(w, "inbox.html", nil); err != nil {
-		s.logger.Error("render inbox partial", "error", err)
-	}
-}
-
 // cleanNext only allows same-site, absolute-path redirects.
 func cleanNext(next string) string {
 	if next == "" || !strings.HasPrefix(next, "/") || strings.HasPrefix(next, "//") {