#21: serve the webmail mail API from the protocols service

The mail screens had no backend at all: they rendered a hardcoded array,
and the storage service that ADR-001 assigned this to is still a health
stub. The API lands here instead, because the folder, UID, MODSEQ, flag
and blob logic already exists and is tested in this service for IMAP.
Reimplementing it in TypeScript would mean two implementations of the
same semantics and two chances to disagree about what a UID means.

Reads use a projected read model rather than hydrated aggregates, which
is the CQRS exception PLAN.md section 2 carves out for webmail queries.
Every query is scoped to the mailbox resolved from the verified session,
never to an identifier taken from the request, so one account cannot read
another's mail by guessing a UID - covered by a test that tries exactly
that and expects 404.

Sending reuses ProcessOutboundEmailUseCase, so mail written in the browser
gets the same treatment as mail submitted over 587: send limits, DKIM
signing, and the durable queue. The From address comes from the session
and never from the request body; letting the body choose it is how a
webmail becomes a relay for spoofed mail.

MIME is parsed server-side because this service already depends on a MIME
library. A message that will not parse still returns its raw text - an
unreadable message beats an inbox that refuses to open one.

Marking a message read updates the flag and the folder counter in one
transaction, and only on a real transition, so re-opening a message cannot
drive unread_count negative.

Verified against the running stack: a message delivered over port 25
appears in the list with its decoded subject and sender, opens, marks
itself read, is found by search, and a message composed in the webmail
reaches outbound_jobs with the session's address as the envelope sender.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/protocols/cmd/lambdamail-protocols/config.go

@@ -14,6 +14,7 @@ type config struct {
 	MailDomain      string
 	SpoolDir        string
 
+	JwtSecret string
 	MasterKey string
 
 	TLSMode           string
@@ -61,6 +62,9 @@ func loadConfig() config {
 		SpoolDir:        envOrDefault("PROTOCOLS_SPOOL_DIR", "/var/lambdamail/spool"),
 
 		MasterKey: os.Getenv("LAMBDAMAIL_MASTER_KEY"),
+		// Shared with the auth service, which mints the webmail sessions this
+		// service verifies on /api/v1/mail/*.
+		JwtSecret: os.Getenv("JWT_SECRET"),
 
 		TLSMode:           strings.ToLower(envOrDefault("TLS_MODE", "traefik")),
 		TraefikAcmeDir:    os.Getenv("TRAEFIK_ACME_DIR"),

services/protocols/cmd/lambdamail-protocols/main.go

@@ -162,7 +162,18 @@ func run(cfg config) {
 	}
 
 	// ------------------------------------------------------------- HTTP API
+	// The webmail reads and sends through this service because the folder,
+	// UID, flag and blob logic already lives here; duplicating it in another
+	// service would mean two implementations of the same IMAP semantics.
+	webmailUC := usecase.NewWebmailUseCase(
+		postgres.NewWebmailRepository(pool), blobReader, submissionUC, authRepo, cfg.PrimaryMailHost,
+	)
+
 	router := httppresentation.NewRouter(usecase.NewIngestReportsUseCase(reportRepo), func() error { return pool.Ping(ctx) })
+	if cfg.JwtSecret == "" {
+		log.Printf("JWT_SECRET is not set: the webmail mail API stays disabled")
+	}
+	router.SetMailAPI(webmailUC, cfg.JwtSecret)
 	router.SetDegradedCheck(certDegraded)
 	applyMtaStsMode(router, cfg)