Phase 5: reply drafts — template/LLM draft, edit, SMTP send (AUD-71)

Implements Phase 5 of AGENTS.md §11 (FR-8, FR-15):

- Message detail pane (GET /partials/message) with body, recommended
  action, reply identity, template picker, editable draft, and history.
- internal/reply: OmniRoute (OpenAI-compatible) chat client and a
  template-based draft generator. All non-JEV models go through
  OmniRoute (§10).
- internal/mailops: SMTP send over smtp.gmail.com:587 with STARTTLS and
  the app password, forcing IPv4 (§9); FR-15 reply identity (send as the
  arrived-at X-Pm-Original-To address, else "Sam Rolfe"); threading via
  In-Reply-To/References; -check-smtp safe verification; and a
  [Gmail]/Sent Mail thread check.
- Migration v5 stores messages.message_id_header and drafts.sent_at;
  mailfetch parses Message-ID.
- Send is user-triggered only: CSRF + UI confirm + confirm=yes guard,
  no auto-send, duplicate-send refused. A sent reply files the original
  under Replied-to/<address> and logs every step (FR-13).
- Tests for reply, mailops SMTP/identity/thread check, store drafts and
  migration v5, and the server draft/edit/send guards.
- docs/phase5-replies.md, README, .env.example, docker-compose updated.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/reply/client_test.go

@@ -0,0 +1,84 @@
+package reply
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+)
+
+func TestCompleteSendsOpenAIRequestAndParsesReply(t *testing.T) {
+	var (
+		gotAuth    string
+		gotSession string
+		gotPath    string
+		gotBody    chatRequest
+	)
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotAuth = r.Header.Get("Authorization")
+		gotSession = r.Header.Get("x-opencode-session")
+		gotPath = r.URL.Path
+		if err := json.NewDecoder(r.Body).Decode(&gotBody); err != nil {
+			t.Errorf("decode request: %v", err)
+		}
+		_ = json.NewEncoder(w).Encode(chatResponse{
+			Model: "test-model",
+			Choices: []struct {
+				Message chatMessage `json:"message"`
+			}{{Message: chatMessage{Role: "assistant", Content: "  Thanks, got it.  "}}},
+		})
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL, "secret-key", "auto/best-chat", slog.New(slog.DiscardHandler))
+	if !c.Configured() {
+		t.Fatal("client should be configured with a key")
+	}
+	got, err := c.Complete(context.Background(), "system prompt", "user prompt")
+	if err != nil {
+		t.Fatalf("Complete() error = %v", err)
+	}
+	if got != "Thanks, got it." {
+		t.Errorf("Complete() = %q, want trimmed reply", got)
+	}
+	if gotPath != "/chat/completions" {
+		t.Errorf("path = %q, want /chat/completions", gotPath)
+	}
+	if gotAuth != "Bearer secret-key" {
+		t.Errorf("Authorization = %q", gotAuth)
+	}
+	if gotSession == "" {
+		t.Error("x-opencode-session header was not set")
+	}
+	if gotBody.Model != "auto/best-chat" || gotBody.Stream {
+		t.Errorf("request = %+v, want non-streaming auto/best-chat", gotBody)
+	}
+	if len(gotBody.Messages) != 2 || gotBody.Messages[0].Role != "system" || gotBody.Messages[1].Role != "user" {
+		t.Errorf("messages = %+v", gotBody.Messages)
+	}
+}
+
+func TestCompleteNotConfigured(t *testing.T) {
+	c := NewClient("http://127.0.0.1:1/v1", "", "auto/best-chat", slog.New(slog.DiscardHandler))
+	if c.Configured() {
+		t.Fatal("client should not be configured without a key")
+	}
+	if _, err := c.Complete(context.Background(), "s", "u"); err != ErrNotConfigured {
+		t.Fatalf("Complete() error = %v, want ErrNotConfigured", err)
+	}
+}
+
+func TestCompleteReportsHTTPError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "nope", http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	c := NewClient(srv.URL, "key", "m", slog.New(slog.DiscardHandler))
+	_, err := c.Complete(context.Background(), "s", "u")
+	if err == nil {
+		t.Fatal("Complete() error = nil, want an error")
+	}
+}