Phase 4: triage actions (delete, move, mark; bulk select) (AUD-70)

Bulk select in the triage list, with delete/move/mark and a recoverable
delete (FR-6, FR-9).

- migration v4: messages.folder + messages.mailbox; folder/category views
- internal/mailops: app folder -> Gmail label moves over IMAP (IPv4), locate
  by X-GM-MSGID, create labels lazily, move/save/reply/restore, flag marks
- mailfetch: CREATE, UID MOVE (COPY+EXPUNGE fallback), STORE flags, X-GM-MSGID search
- server: POST /actions/bulk with CSRF, UI delete confirmation, second
  confirmation for messages classified Spam (never auto-deleted), per-message
  and summary action-log rows (FR-13)
- inbox: select-all toolbar, checkboxes, folder nav, Restore on non-inbox rows

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/store/messages.go

@@ -26,6 +26,11 @@ type Message struct {
 	ReceivedAt      time.Time
 	IMAPUID         int64
 	IMAPUIDValidity int64
+	// Folder is the app folder the message is filed under (Phase 4, FR-6/FR-9):
+	// inbox, delete, saved, or replied.
+	Folder string
+	// Mailbox is the exact IMAP label the message currently lives in on Gmail.
+	Mailbox string
 }
 
 // MessageListItem is a message plus its latest classification, when present.
@@ -38,6 +43,24 @@ type MessageListItem struct {
 	HasClassification bool
 }
 
+// App folders (Phase 4). A folder is a low-cardinality navigation concept; the
+// exact Gmail label is tracked separately on each message.
+const (
+	FolderInbox   = "inbox"
+	FolderDelete  = "delete"
+	FolderSaved   = "saved"
+	FolderReplied = "replied"
+)
+
+// ValidFolder reports whether folder is an app folder the UI knows how to show.
+func ValidFolder(folder string) bool {
+	switch folder {
+	case FolderInbox, FolderDelete, FolderSaved, FolderReplied:
+		return true
+	}
+	return false
+}
+
 // UpsertMessage inserts a message, or refreshes the mutable fields when the
 // same Gmail id is seen again. received_at is preserved on update so the
 // original arrival time is stable.
@@ -99,6 +122,7 @@ SELECT
     COALESCE(m.to_addr, ''), COALESCE(m.subject, ''), COALESCE(m.body_text, ''),
     COALESCE(m.source_address, ''), COALESCE(m.date_sent, ''), m.received_at,
     COALESCE(m.imap_uid, 0), COALESCE(m.imap_uidvalidity, 0),
+    COALESCE(m.folder, 'inbox'),
     COALESCE(c.category, ''), COALESCE(c.importance, ''),
     COALESCE(c.action, ''), COALESCE(c.confidence, 0)
 FROM messages m
@@ -125,7 +149,7 @@ LIMIT ?`
 			&item.ID, &item.GmailID, &item.ThreadID, &item.FromAddr,
 			&item.ToAddr, &item.Subject, &item.BodyText,
 			&item.SourceAddress, &dateSent, &received,
-			&item.IMAPUID, &item.IMAPUIDValidity,
+			&item.IMAPUID, &item.IMAPUIDValidity, &item.Folder,
 			&item.Category, &item.Importance, &item.Action, &item.Confidence,
 		); err != nil {
 			return nil, fmt.Errorf("scan message: %w", err)