feat(auth): trusted senders table and API

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

migrations/0016_trusted_senders.up.sql

@@ -0,0 +1,14 @@
+-- Senders a mailbox has said it trusts.
+--
+-- Two things hang off one decision: mail from a trusted sender is not filed as
+-- spam, and its remote images load without asking. Both used to be forgotten:
+-- moving a message out of Junk taught nothing, so the next reply from the same
+-- person went to Junk again, and the choice to show images lived in one
+-- browser's storage.
+CREATE TABLE trusted_senders (
+    mailbox_id UUID NOT NULL REFERENCES mailboxes(id) ON DELETE CASCADE,
+    -- Lowercased, so one person is one row however they spell their address.
+    address    VARCHAR(320) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    PRIMARY KEY (mailbox_id, address)
+);