Phase 4: triage actions (delete, move, mark; bulk select) (AUD-70)

Bulk select in the triage list, with delete/move/mark and a recoverable
delete (FR-6, FR-9).

- migration v4: messages.folder + messages.mailbox; folder/category views
- internal/mailops: app folder -> Gmail label moves over IMAP (IPv4), locate
  by X-GM-MSGID, create labels lazily, move/save/reply/restore, flag marks
- mailfetch: CREATE, UID MOVE (COPY+EXPUNGE fallback), STORE flags, X-GM-MSGID search
- server: POST /actions/bulk with CSRF, UI delete confirmation, second
  confirmation for messages classified Spam (never auto-deleted), per-message
  and summary action-log rows (FR-13)
- inbox: select-all toolbar, checkboxes, folder nav, Restore on non-inbox rows

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/server/server.go

@@ -20,6 +20,7 @@ import (
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/classify"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailfetch"
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailops"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/session"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/store"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/version"
@@ -41,6 +42,7 @@ type Server struct {
 	sessions   *session.Manager
 	fetcher    *mailfetch.Fetcher
 	classifier *classify.Classifier
+	actions    MailActions
 }
 
 // New builds a Server. It does not start listening.
@@ -70,6 +72,7 @@ func New(cfg *config.Config, st *store.Store, logger *slog.Logger) (*Server, err
 			classify.NewClient(cfg.JEVBaseURL, cfg.JEVAPIKey, cfg.JEVModel, logger),
 			st, logger, cfg.ClassifyConcurrency, cfg.ClassifyMaxMessages,
 		),
+		actions: mailops.New(cfg, logger),
 	}
 	s.http = &http.Server{
 		Addr:              cfg.Addr,
@@ -122,6 +125,9 @@ func (s *Server) Handler() http.Handler {
 	mux.HandleFunc("POST /actions/classify", s.requireAuth(s.handleClassify))
 	mux.HandleFunc("POST /actions/reclassify", s.requireAuth(s.handleReclassify))
 
+	// Phase 4 (FR-6/FR-9): bulk triage actions (delete, move, mark) and restore.
+	mux.HandleFunc("POST /actions/bulk", s.requireAuth(s.handleBulkAction))
+
 	// FR-14: editable category list.
 	mux.HandleFunc("GET /categories", s.requireAuth(s.handleCategories))
 	mux.HandleFunc("POST /categories/add", s.requireAuth(s.handleCategoryAdd))