feat(protocols): trusted senders are not filed as spam, when the message proves its sender

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/protocols/internal/application/usecase/process_inbound_email.go

@@ -67,6 +67,7 @@ type ProcessInboundEmailUseCase struct {
 	trackerManager *MailboxTrackerManager
 	reportIngestor *IngestDeliveredReportsUseCase
 	rules          *ApplyRulesUseCase
+	trusted        port.TrustedSenders
 	submission     *ProcessOutboundEmailUseCase
 	auth           port.AuthRepository
 	replyHost      string
@@ -294,6 +295,11 @@ func (uc *ProcessInboundEmailUseCase) Handle(ctx context.Context, input ProcessI
 		// Each recipient's own rules decide their own copy: two mailboxes on
 		// this server receiving the same message may file it differently.
 		folder := targetFolder
+		// Before the rules, so a filter still has the last word: the spam
+		// verdict is the filter's guess and the rules are the mailbox's own.
+		if folder == "Junk" && uc.rescuedFromJunk(ctx, recipient.ID, headers.FromAddress, input.Sender, authResult) {
+			folder = "INBOX"
+		}
 		var decision RuleDecision
 		if uc.rules != nil {
 			decision = uc.rules.For(ctx, recipient.ID, input.RecipientAddresses[i], input.Sender, payload)