Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/store.go

@@ -76,11 +76,69 @@ func buildDSN(path string) string {
 	return "file:" + abs + "?" + q.Encode()
 }
 
-// migrate applies the embedded schema. It is safe to run on every start.
+// migrate applies the embedded schema, then any incremental migrations that
+// add columns to a database created by an earlier release. It is safe to run on
+// every start.
 func (s *Store) migrate(ctx context.Context) error {
 	if _, err := s.db.ExecContext(ctx, schemaSQL); err != nil {
 		return fmt.Errorf("apply schema: %w", err)
 	}
+	return s.applyMigrations(ctx)
+}
+
+// applyMigrations brings an existing database up to the latest schema version.
+// Version 1 is the base schema (schema.sql); version 2 adds IMAP bookkeeping
+// columns (AGENTS.md §9 / Phase 2). Each step is idempotent.
+func (s *Store) applyMigrations(ctx context.Context) error {
+	version, err := s.SchemaVersion(ctx)
+	if err != nil {
+		return fmt.Errorf("read schema version: %w", err)
+	}
+	if version < 2 {
+		for _, col := range []struct{ table, name, typ string }{
+			{"messages", "imap_uid", "INTEGER"},
+			{"messages", "imap_uidvalidity", "INTEGER"},
+		} {
+			if err := s.ensureColumn(ctx, col.table, col.name, col.typ); err != nil {
+				return err
+			}
+		}
+		if _, err := s.db.ExecContext(ctx,
+			`INSERT OR IGNORE INTO schema_migrations (version) VALUES (2)`); err != nil {
+			return fmt.Errorf("record schema version 2: %w", err)
+		}
+	}
+	return nil
+}
+
+// ensureColumn adds a column when it is missing. SQLite has no
+// "ADD COLUMN IF NOT EXISTS", so the current shape is inspected first.
+func (s *Store) ensureColumn(ctx context.Context, table, name, typ string) error {
+	rows, err := s.db.QueryContext(ctx, fmt.Sprintf("PRAGMA table_info(%s)", table))
+	if err != nil {
+		return fmt.Errorf("inspect %s: %w", table, err)
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var (
+			cid, notnull, pk int
+			dflt             sql.NullString
+			colName, colType string
+		)
+		if err := rows.Scan(&cid, &colName, &colType, &notnull, &dflt, &pk); err != nil {
+			return fmt.Errorf("scan %s columns: %w", table, err)
+		}
+		if colName == name {
+			return nil
+		}
+	}
+	if err := rows.Err(); err != nil {
+		return fmt.Errorf("inspect %s columns: %w", table, err)
+	}
+	if _, err := s.db.ExecContext(ctx,
+		fmt.Sprintf("ALTER TABLE %s ADD COLUMN %s %s", table, name, typ)); err != nil {
+		return fmt.Errorf("add %s.%s: %w", table, name, err)
+	}
 	return nil
 }