Phase 3: JEV classification, rules table, editable categories (AUD-69)

Implements FR-3, FR-4, FR-5 and FR-14.

- internal/classify: TypeSafe System One (JEV) HTTP client with the confirmed
  request/response shape, retry with backoff on 429/529/5xx, a plain-text rule
  engine (first match wins, overrides only the named fields), and bounded
  orchestration with a per-run cap.
- internal/store: migration v3 adds an editable `categories` table (name =
  JEV Choice option and classifications key; rename cascades, remove reassigns)
  and seeds a starter rules version once. Classification persistence, coverage,
  and pending/all message queries.
- internal/server: POST /actions/classify and /actions/reclassify, plus the
  FR-14 category editor (GET /categories and add/rename/remove). The triage list
  now groups by the live category list and shows action + confidence.
- CLI: -classify and -classify-all for n8n.
- Docs: docs/phase3-classify.md with the confirmed JEV shape, a live read-only
  classification, and the DoD evidence.

DoD: all 100 stored messages have a non-null category, importance, and suggested
action (0 nulls); JEV picked a newly added/renamed category for 6 real messages
over HTTP. One live JEV call recorded in the phase doc.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

internal/config/config.go

@@ -28,6 +28,16 @@ const (
 	DefaultIMAPPort         = 993
 	DefaultIMAPLookbackDays = 14
 	DefaultIMAPMaxMessages  = 100
+
+	// JEV (TypeSafe System One) defaults. The base URL is fixed by the TypeSafe
+	// docs (https://docs.typesafe.ai/api.md); JEV_BASE_URL overrides it.
+	DefaultJEVBaseURL = "https://api.typesafe.ai"
+	DefaultJEVModel   = "jev-latest"
+
+	// Classifier defaults (FR-3). Concurrency bounds in-flight JEV requests;
+	// max messages bounds one run so a scheduled scan stays cheap.
+	DefaultClassifyConcurrency = 4
+	DefaultClassifyMaxMessages = 200
 )
 
 // Config is the fully resolved runtime configuration.
@@ -66,6 +76,12 @@ type Config struct {
 	JEVBaseURL string
 	// JEVAPIKey authenticates to JEV. Secret.
 	JEVAPIKey string
+	// JEVModel is the System One model alias (default jev-latest).
+	JEVModel string
+	// ClassifyConcurrency bounds in-flight JEV requests per run.
+	ClassifyConcurrency int
+	// ClassifyMaxMessages caps how many messages one classify run processes.
+	ClassifyMaxMessages int
 
 	// OmniRouteBaseURL is the base URL of the OmniRoute gateway.
 	OmniRouteBaseURL string
@@ -99,8 +115,9 @@ func Load() (*Config, error) {
 		Password:         os.Getenv("EMAIL_AGENT_PASSWORD"),
 		LogLevel:         strings.ToLower(getenvDefault("EMAIL_AGENT_LOG_LEVEL", "info")),
 		PublicBaseURL:    strings.TrimRight(getenvDefault("EMAIL_AGENT_PUBLIC_BASE_URL", "http://localhost:8790"), "/"),
-		JEVBaseURL:       strings.TrimRight(os.Getenv("JEV_BASE_URL"), "/"),
+		JEVBaseURL:       strings.TrimRight(getenvDefault("JEV_BASE_URL", DefaultJEVBaseURL), "/"),
 		JEVAPIKey:        os.Getenv("JEV_API_KEY"),
+		JEVModel:         getenvDefault("JEV_MODEL", DefaultJEVModel),
 		OmniRouteBaseURL: strings.TrimRight(os.Getenv("OMNIROUTE_BASE_URL"), "/"),
 		OmniRouteAPIKey:  os.Getenv("OMNIROUTE_API_KEY"),
 		GmailUser:        os.Getenv("GMAIL_USER"),
@@ -116,6 +133,8 @@ func Load() (*Config, error) {
 	c.IMAPPort = imapPort
 	c.IMAPLookbackDays = getenvDefaultInt("EMAIL_AGENT_IMAP_LOOKBACK_DAYS", DefaultIMAPLookbackDays)
 	c.IMAPMaxMessages = getenvDefaultInt("EMAIL_AGENT_IMAP_MAX_MESSAGES", DefaultIMAPMaxMessages)
+	c.ClassifyConcurrency = getenvDefaultInt("EMAIL_AGENT_CLASSIFY_CONCURRENCY", DefaultClassifyConcurrency)
+	c.ClassifyMaxMessages = getenvDefaultInt("EMAIL_AGENT_CLASSIFY_MAX_MESSAGES", DefaultClassifyMaxMessages)
 
 	port, err := resolvePort()
 	if err != nil {
@@ -219,6 +238,10 @@ func (c *Config) GmailConfigured() bool {
 	return strings.TrimSpace(c.GmailUser) != "" && strings.TrimSpace(c.GmailAppPassword) != ""
 }
 
+// JEVConfigured reports whether JEV classification can be attempted. The
+// service still starts without a key; only classification is unavailable.
+func (c *Config) JEVConfigured() bool { return strings.TrimSpace(c.JEVAPIKey) != "" }
+
 // IsProduction reports whether the service runs in the production environment.
 func (c *Config) IsProduction() bool { return c.Env == "production" }