#4: implement F2 sub-project 1 - IMAP core (auth, LIST, SELECT, FETCH, STORE)

Adds a real :143 IMAP listener to the Go protocols service: a mailbox
owner authenticates over IMAP (Argon2id against mailboxes.password_hash,
enumeration-resistant per PLAN.md section 14.6), lists folders, selects
INBOX, fetches messages F1's SMTP path already persisted - including real
ENVELOPE/BODY[] built from the actual stored MIME bytes via go-imap/v2's
own ExtractEnvelope/ExtractBodySection helpers, not reconstructed from
denormalized columns - and sets/reads flags via STORE.

- ImapSessionUseCase orchestrates auth, folder listing/selection, message
  querying, and flag mutation against new Postgres repositories (auth,
  folders, message query, flags) and a local-disk blob reader.
- A github.com/emersion/go-imap/v2 (pinned v2.0.0-beta.8) Backend/Session
  implements 7 real methods (Login, List, Select, Unselect, Status, Fetch,
  Store) plus a correct no-op Poll; the other 10 of the interface's 18
  methods (Create/Delete/Rename/Subscribe/Unsubscribe/Append/Idle/Expunge/
  Search/Copy) are explicit stubs returning a clear "not yet implemented"
  IMAP error - SEARCH/EXPUNGE/COPY/MOVE, IDLE/CONDSTORE, mailbox
  management, and APPEND are separate follow-up sub-projects per the
  design doc's agreed ordering with the user.

Verified end-to-end with a real go-imap/v2 imapclient (embedded Postgres,
no Docker needed) driving Login -> Select -> Fetch -> Store -> List
against a message seeded through F1's real SMTP use case, proving true
SMTP-write/IMAP-read interop, not just isolated unit tests.

Built via 8 sequential tasks under subagent-driven development, each
independently reviewed, plus a final whole-branch review. Two real bugs
were found and fixed before merge, both exactly the kind unit tests with
fakes cannot catch:
- Store's UID-set resolution silently no-op'd on dynamic ranges like
  "UID STORE 1:*" (the common "mark all as read" operation) after an
  earlier draft bypassed the folder's real message list; restored to
  resolve against real messages via the same pattern Fetch already used
  correctly, with tests proving both dynamic ranges and non-UID STORE.
- go-imap/v2's server calls Session.Poll() implicitly before the status
  response of nearly every authenticated command (FETCH/STORE/SEARCH/
  APPEND/COPY), not just IDLE as assumed - a hard-stubbed Poll broke every
  real command through this path; fixed to a correct no-op.
- List had zero test coverage despite being committed scope; added unit
  tests for wildcard/delimiter matching plus a real E2E LIST assertion.

Known follow-up, not blocking: a pre-existing test-fixture hygiene gap
(hardcoded content_sha256 blob hashes with no cleanup, shared across
several Postgres integration test files including one new to this
branch) causes local-dev test collisions on repeated runs against a
persistent database - invisible to CI (fresh Postgres per run) but worth
a cleanup pass.

services/protocols/internal/application/port/auth_repository.go

@@ -0,0 +1,20 @@
+package port
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+// MailboxAuth is the subset of mailbox data needed to verify a login.
+type MailboxAuth struct {
+	ID           uuid.UUID
+	PasswordHash string
+}
+
+// AuthRepository resolves a login address to its stored credential.
+type AuthRepository interface {
+	// FindByAddress returns nil, nil (not an error) when no active mailbox
+	// with an active domain matches address.
+	FindByAddress(ctx context.Context, address string) (*MailboxAuth, error)
+}

services/protocols/internal/application/port/blob_reader.go

@@ -0,0 +1,12 @@
+package port
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+)
+
+// BlobReader reads a previously stored message's full raw bytes.
+type BlobReader interface {
+	ReadByID(ctx context.Context, blobID uuid.UUID) ([]byte, error)
+}

services/protocols/internal/application/port/flag_repository.go

@@ -0,0 +1,21 @@
+package port
+
+import "context"
+
+// FlagOp mirrors imap.StoreFlagsOp without importing the imap package here
+// (this port stays framework-free).
+type FlagOp int
+
+const (
+	FlagOpAdd FlagOp = iota
+	FlagOpDel
+	FlagOpSet
+)
+
+// FlagRepository mutates a message's IMAP flags (STORE).
+type FlagRepository interface {
+	// SetFlags applies op with flags to the message identified by
+	// (folderID, uid). Add/Del insert/delete individual message_flags rows;
+	// Set replaces the message's full flag set in one transaction.
+	SetFlags(ctx context.Context, folderID string, uid uint32, op FlagOp, flags []string) error
+}

services/protocols/internal/application/port/imap_folder_repository.go

@@ -0,0 +1,20 @@
+package port
+
+import "context"
+
+// ImapFolderRecord is the IMAP-relevant subset of a folder row.
+type ImapFolderRecord struct {
+	ID          string
+	Name        string
+	UIDNext     uint32
+	UIDValidity uint32
+	NumMessages uint32
+}
+
+// ImapFolderRepository resolves a mailbox's folders for LIST and SELECT.
+type ImapFolderRepository interface {
+	ListFolders(ctx context.Context, mailboxID string) ([]ImapFolderRecord, error)
+	// FindByName returns nil, nil (not an error) when no folder with that
+	// name exists for the mailbox.
+	FindByName(ctx context.Context, mailboxID, name string) (*ImapFolderRecord, error)
+}

services/protocols/internal/application/port/message_query_repository.go

@@ -0,0 +1,26 @@
+package port
+
+import (
+	"context"
+	"time"
+
+	"github.com/google/uuid"
+)
+
+// MessageRecord is one message's IMAP-relevant data.
+type MessageRecord struct {
+	UID        uint32
+	BlobID     uuid.UUID
+	SizeBytes  int64
+	ReceivedAt time.Time
+	Flags      []string
+}
+
+// MessageQueryRepository lists a folder's messages for FETCH.
+type MessageQueryRepository interface {
+	// ListMessages returns every message in folderID, ordered by UID
+	// ascending. The caller derives IMAP sequence numbers from this order
+	// (row N is sequence number N+1) - safe because this sub-project never
+	// expunges a message, so sequence numbers never need remapping.
+	ListMessages(ctx context.Context, folderID string) ([]MessageRecord, error)
+}