Phase 2: Gmail IMAP fetch (IPv4), FR-2 source address, real mail in dashboard (AUD-67)

- internal/mailfetch: stdlib-only read-only IMAP client (LOGIN, SELECT,
  UID SEARCH, UID FETCH) that always dials tcp4; IPv6 to Gmail is broken
  from .13 and caused a socket EOF.
- MIME parsing to text, RFC2047 header decoding, FR-2 source address:
  X-Pm-Original-To -> To -> Received 'for <addr>' -> Return-Path, never
  Delivered-To. The matched header is recorded for audit.
- store: Message upsert/list/count + LogAction; schema migration v2 adds
  imap_uid and imap_uidvalidity.
- server: dashboard and /partials/inbox render real mail grouped by
  category with a recommended action; POST /actions/fetch runs a scan
  (CSRF-checked); nav counts; 'Check mail' button.
- config: GMAIL_USER, GMAIL_APP_PASSWORD, IMAP host/port/lookback/max.
- cmd: -fetch runs one scan and exits (n8n/CLI entry point, FR-1).
- compose/.env.example expose the Gmail + IMAP settings.
- tests: FR-2 precedence, MIME bodies, IMAP literal/parser, store
  upsert/migration, inbox rendering.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

web/templates/inbox.html

@@ -1,5 +1,33 @@
+<div class="scan-note-slot">
+  {{if .Note}}<div class="scan-note" role="status">{{.Note}}</div>{{end}}
+</div>
+
+{{if .Groups}}
+  {{range .Groups}}
+  <section class="msg-group" aria-label="{{.Name}}">
+    <div class="msg-group-head">
+      <span class="msg-group-name">{{.Name}}</span>
+      <span class="count">{{len .Messages}}</span>
+    </div>
+    {{range .Messages}}
+    <div class="msg-row">
+      <div class="msg-main">
+        <div class="msg-from">{{.From}}</div>
+        <div class="msg-subject">{{.Subject}}</div>
+        {{if .SourceAddr}}<div class="msg-source">arrived at <span class="source-addr">{{.SourceAddr}}</span></div>{{end}}
+      </div>
+      <div class="msg-meta">
+        <span class="pill action-pill">{{.Action}}</span>
+        {{if .When}}<span class="msg-when">{{.When}}</span>{{end}}
+      </div>
+    </div>
+    {{end}}
+  </section>
+  {{end}}
+{{else}}
 <div class="empty-state">
   <div class="empty-title">No messages yet</div>
-  <p class="empty-copy">Mail fetch arrives in Phase 2. New messages will appear here, grouped by category, with a recommended action on each row.</p>
-  <span class="pill">IMAP scan not connected</span>
+  <p class="empty-copy">Use <strong>Check mail</strong> to fetch from Gmail. New messages appear here, grouped by category, with a recommended action on each row.</p>
+  <span class="pill">No stored messages</span>
 </div>
+{{end}}