Phase 3: JEV classification, rules table, editable categories (AUD-69)

Implements FR-3, FR-4, FR-5 and FR-14.

- internal/classify: TypeSafe System One (JEV) HTTP client with the confirmed
  request/response shape, retry with backoff on 429/529/5xx, a plain-text rule
  engine (first match wins, overrides only the named fields), and bounded
  orchestration with a per-run cap.
- internal/store: migration v3 adds an editable `categories` table (name =
  JEV Choice option and classifications key; rename cascades, remove reassigns)
  and seeds a starter rules version once. Classification persistence, coverage,
  and pending/all message queries.
- internal/server: POST /actions/classify and /actions/reclassify, plus the
  FR-14 category editor (GET /categories and add/rename/remove). The triage list
  now groups by the live category list and shows action + confidence.
- CLI: -classify and -classify-all for n8n.
- Docs: docs/phase3-classify.md with the confirmed JEV shape, a live read-only
  classification, and the DoD evidence.

DoD: all 100 stored messages have a non-null category, importance, and suggested
action (0 nulls); JEV picked a newly added/renamed category for 6 real messages
over HTTP. One live JEV call recorded in the phase doc.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

cmd/email-agent/main.go

@@ -12,6 +12,7 @@ import (
 	"syscall"
 	"time"
 
+	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/classify"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/config"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/mailfetch"
 	"gitea.lab.audasmedia.com.au/sam/email_agent/internal/server"
@@ -24,6 +25,8 @@ func main() {
 		showVersion = flag.Bool("version", false, "print version information and exit")
 		healthcheck = flag.Bool("healthcheck", false, "probe the local /health endpoint and exit")
 		fetchNow    = flag.Bool("fetch", false, "run one Gmail IMAP scan and exit")
+		classifyNow = flag.Bool("classify", false, "classify pending messages with JEV and exit")
+		classifyAll = flag.Bool("classify-all", false, "re-classify every stored message with JEV and exit")
 	)
 	flag.Parse()
 
@@ -57,6 +60,14 @@ func main() {
 		return
 	}
 
+	if *classifyNow || *classifyAll {
+		if err := runClassify(cfg, logger, *classifyAll); err != nil {
+			fmt.Fprintf(os.Stderr, "classify failed: %v\n", err)
+			os.Exit(1)
+		}
+		return
+	}
+
 	if err := run(cfg, logger); err != nil {
 		logger.Error("fatal", "error", err)
 		os.Exit(1)
@@ -125,6 +136,41 @@ func runFetch(cfg *config.Config, logger *slog.Logger) error {
 	return nil
 }
 
+// runClassify classifies messages and exits. It is the n8n/CLI entry point for
+// FR-3, separate from the HTTP service so a scheduled scan can be bounded and
+// observed. all=true re-classifies every message, for use after the category
+// list or rules change.
+func runClassify(cfg *config.Config, logger *slog.Logger, all bool) error {
+	if !cfg.JEVConfigured() {
+		return classify.ErrNotConfigured
+	}
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	st, err := store.Open(ctx, cfg.DBPath)
+	if err != nil {
+		return fmt.Errorf("open store: %w", err)
+	}
+	defer func() { _ = st.Close() }()
+
+	classifier := classify.NewClassifier(
+		classify.NewClient(cfg.JEVBaseURL, cfg.JEVAPIKey, cfg.JEVModel, logger),
+		st, logger, cfg.ClassifyConcurrency, cfg.ClassifyMaxMessages,
+	)
+	var sum classify.Summary
+	if all {
+		sum, err = classifier.RunAll(ctx)
+	} else {
+		sum, err = classifier.Run(ctx)
+	}
+	if err != nil {
+		return err
+	}
+	fmt.Printf("considered=%d classified=%d failed=%d remaining=%d model=%s rules_version=%d\n",
+		sum.Considered, sum.Classified, sum.Failed, sum.Remaining, sum.Model, sum.RulesVersion)
+	return nil
+}
+
 // probeHealth requests the local health endpoint. It exists so the container
 // healthcheck does not need an external HTTP client in the image.
 func probeHealth(port int) error {