Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/store_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"path/filepath"
 	"testing"
+	"time"
 )
 
 func TestOpenCreatesSchema(t *testing.T) {
@@ -83,3 +84,110 @@ func TestMessagesInsertAndRead(t *testing.T) {
 		t.Errorf("subject = %q, want %q", subject, "Hello")
 	}
 }
+
+func TestUpsertAndListMessages(t *testing.T) {
+	ctx := context.Background()
+	s, err := Open(ctx, filepath.Join(t.TempDir(), "email_agent.db"))
+	if err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+	defer s.Close()
+
+	m := &Message{
+		GmailID:         "1234000000000000000",
+		ThreadID:        "999",
+		FromAddr:        "favrolfe@gmail.com",
+		ToAddr:          "Hello@where-woof.com",
+		Subject:         "A forwarded hello",
+		BodyText:        "body text",
+		SourceAddress:   "Hello@where-woof.com",
+		DateSent:        time.Date(2026, 10, 1, 9, 30, 0, 0, time.UTC),
+		IMAPUID:         42,
+		IMAPUIDValidity: 7,
+	}
+	id, err := s.UpsertMessage(ctx, m)
+	if err != nil {
+		t.Fatalf("UpsertMessage() error = %v", err)
+	}
+	if id == 0 {
+		t.Fatal("UpsertMessage() returned id 0")
+	}
+
+	// A second upsert with the same Gmail id must update, not duplicate, and
+	// must not move received_at.
+	m.Subject = "Updated subject"
+	id2, err := s.UpsertMessage(ctx, m)
+	if err != nil {
+		t.Fatalf("second UpsertMessage() error = %v", err)
+	}
+	if id2 != id {
+		t.Errorf("second upsert id = %d, want %d", id2, id)
+	}
+
+	n, err := s.CountMessages(ctx)
+	if err != nil {
+		t.Fatalf("CountMessages() error = %v", err)
+	}
+	if n != 1 {
+		t.Fatalf("CountMessages() = %d, want 1", n)
+	}
+
+	list, err := s.ListMessages(ctx, 10)
+	if err != nil {
+		t.Fatalf("ListMessages() error = %v", err)
+	}
+	if len(list) != 1 {
+		t.Fatalf("ListMessages() len = %d, want 1", len(list))
+	}
+	got := list[0]
+	if got.Subject != "Updated subject" {
+		t.Errorf("Subject = %q, want updated value", got.Subject)
+	}
+	if got.SourceAddress != "Hello@where-woof.com" {
+		t.Errorf("SourceAddress = %q", got.SourceAddress)
+	}
+	if got.IMAPUID != 42 || got.IMAPUIDValidity != 7 {
+		t.Errorf("IMAP bookkeeping = (%d, %d), want (42, 7)", got.IMAPUID, got.IMAPUIDValidity)
+	}
+	if got.HasClassification {
+		t.Error("HasClassification = true with no classifications row")
+	}
+}
+
+func TestMigrationAddsIMAPColumns(t *testing.T) {
+	ctx := context.Background()
+	s, err := Open(ctx, filepath.Join(t.TempDir(), "email_agent.db"))
+	if err != nil {
+		t.Fatalf("Open() error = %v", err)
+	}
+	defer s.Close()
+
+	v, err := s.SchemaVersion(ctx)
+	if err != nil {
+		t.Fatalf("SchemaVersion() error = %v", err)
+	}
+	if v < 2 {
+		t.Errorf("SchemaVersion() = %d, want >= 2", v)
+	}
+
+	for _, col := range []string{"imap_uid", "imap_uidvalidity"} {
+		var found bool
+		rows, err := s.DB().QueryContext(ctx, `SELECT name FROM pragma_table_info('messages')`)
+		if err != nil {
+			t.Fatalf("pragma_table_info: %v", err)
+		}
+		for rows.Next() {
+			var name string
+			if err := rows.Scan(&name); err != nil {
+				t.Fatalf("scan: %v", err)
+			}
+			if name == col {
+				found = true
+			}
+		}
+		_ = rows.Close()
+		if !found {
+			t.Errorf("column %q missing after migration", col)
+		}
+	}
+}