#21: serve the webmail mail API from the protocols service

The mail screens had no backend at all: they rendered a hardcoded array,
and the storage service that ADR-001 assigned this to is still a health
stub. The API lands here instead, because the folder, UID, MODSEQ, flag
and blob logic already exists and is tested in this service for IMAP.
Reimplementing it in TypeScript would mean two implementations of the
same semantics and two chances to disagree about what a UID means.

Reads use a projected read model rather than hydrated aggregates, which
is the CQRS exception PLAN.md section 2 carves out for webmail queries.
Every query is scoped to the mailbox resolved from the verified session,
never to an identifier taken from the request, so one account cannot read
another's mail by guessing a UID - covered by a test that tries exactly
that and expects 404.

Sending reuses ProcessOutboundEmailUseCase, so mail written in the browser
gets the same treatment as mail submitted over 587: send limits, DKIM
signing, and the durable queue. The From address comes from the session
and never from the request body; letting the body choose it is how a
webmail becomes a relay for spoofed mail.

MIME is parsed server-side because this service already depends on a MIME
library. A message that will not parse still returns its raw text - an
unreadable message beats an inbox that refuses to open one.

Marking a message read updates the flag and the folder counter in one
transaction, and only on a real transition, so re-opening a message cannot
drive unread_count negative.

Verified against the running stack: a message delivered over port 25
appears in the list with its decoded subject and sender, opens, marks
itself read, is found by search, and a message composed in the webmail
reaches outbound_jobs with the session's address as the envelope sender.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yaml

@@ -194,6 +194,9 @@ services:
     environment:
       DATABASE_URL: postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB}?sslmode=disable
       REDIS_URL: redis://:${REDIS_PASSWORD}@redis:6379
+      # Shared with the auth service: it mints the webmail sessions and this
+      # service verifies them on /api/v1/mail/*.
+      JWT_SECRET: ${JWT_SECRET:?required}
       RSPAMD_URL: http://rspamd:11333
       CLAMAV_ADDR: clamav:3310
       PRIMARY_MAIL_HOST: ${PRIMARY_MAIL_HOST:?required}
@@ -262,6 +265,9 @@ services:
       PORT: 3000
       AUTH_SERVICE_URL: http://auth:3001
       STORAGE_SERVICE_URL: http://storage:3002
+      # The mail screens read and send through the protocols service, which
+      # owns the folder, UID, flag and blob logic.
+      PROTOCOLS_SERVICE_URL: http://protocols:8080
       NEXT_PUBLIC_APP_URL: https://${WEBMAIL_HOST:?required}
       # Isolation of the two surfaces (section 14.1). With ADMIN_HOST set the
       # console answers only on that host; otherwise it lives under
@@ -276,6 +282,7 @@ services:
     depends_on:
       auth: { condition: service_healthy }
       storage: { condition: service_healthy }
+      protocols: { condition: service_healthy }
     labels:
       - traefik.enable=true
       # With the service on two networks Traefik may route via the wrong one