Phase 5: reply drafts — template/LLM draft, edit, SMTP send (AUD-71)

Implements Phase 5 of AGENTS.md §11 (FR-8, FR-15):

- Message detail pane (GET /partials/message) with body, recommended
  action, reply identity, template picker, editable draft, and history.
- internal/reply: OmniRoute (OpenAI-compatible) chat client and a
  template-based draft generator. All non-JEV models go through
  OmniRoute (§10).
- internal/mailops: SMTP send over smtp.gmail.com:587 with STARTTLS and
  the app password, forcing IPv4 (§9); FR-15 reply identity (send as the
  arrived-at X-Pm-Original-To address, else "Sam Rolfe"); threading via
  In-Reply-To/References; -check-smtp safe verification; and a
  [Gmail]/Sent Mail thread check.
- Migration v5 stores messages.message_id_header and drafts.sent_at;
  mailfetch parses Message-ID.
- Send is user-triggered only: CSRF + UI confirm + confirm=yes guard,
  no auto-send, duplicate-send refused. A sent reply files the original
  under Replied-to/<address> and logs every step (FR-13).
- Tests for reply, mailops SMTP/identity/thread check, store drafts and
  migration v5, and the server draft/edit/send guards.
- docs/phase5-replies.md, README, .env.example, docker-compose updated.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cmd/email-agent/main.go

@@ -15,6 +15,7 @@ import (
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/classify"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailfetch"
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailops"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/server"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/store"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/version"
@@ -27,6 +28,7 @@ func main() {
 		fetchNow    = flag.Bool("fetch", false, "run one Gmail IMAP scan and exit")
 		classifyNow = flag.Bool("classify", false, "classify pending messages with JEV and exit")
 		classifyAll = flag.Bool("classify-all", false, "re-classify every stored message with JEV and exit")
+		checkSMTP   = flag.Bool("check-smtp", false, "verify the Gmail SMTP connection (IPv4 + STARTTLS + login) and exit; sends no mail")
 	)
 	flag.Parse()
 
@@ -68,6 +70,15 @@ func main() {
 		return
 	}
 
+	if *checkSMTP {
+		if err := runCheckSMTP(cfg, logger); err != nil {
+			fmt.Fprintf(os.Stderr, "smtp check failed: %v\n", err)
+			os.Exit(1)
+		}
+		fmt.Println("smtp check ok: ipv4 + starttls + auth (no mail sent)")
+		return
+	}
+
 	if err := run(cfg, logger); err != nil {
 		logger.Error("fatal", "error", err)
 		os.Exit(1)
@@ -171,6 +182,18 @@ func runClassify(cfg *config.Config, logger *slog.Logger, all bool) error {
 	return nil
 }
 
+// runCheckSMTP verifies the Gmail submission path (IPv4 + STARTTLS + app
+// password) without sending a message. It is the safe part of the Phase 5 send
+// verification; the real send needs Sam's explicit approval.
+func runCheckSMTP(cfg *config.Config, logger *slog.Logger) error {
+	if !cfg.GmailConfigured() {
+		return mailops.ErrNotConfigured
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+	return mailops.New(cfg, logger).CheckSMTP(ctx)
+}
+
 // probeHealth requests the local health endpoint. It exists so the container
 // healthcheck does not need an external HTTP client in the image.
 func probeHealth(port int) error {