#1: implement F0 foundation - monorepo, migrations, Go domain layer, service skeletons, CI

Stands up the LambdaMail monorepo per PLAN.md's F0 milestone: local dev
scaffolding (.env.example, Makefile, .gitignore excluding PLAN.md/docs/
.superpowers/), the full initial Postgres schema as a golang-migrate
migration, the complete Go domain layer for services/protocols (value
objects, entities, domain events - zero external imports beyond
github.com/google/uuid) with unit tests, health-checked service skeletons
for auth/storage (TypeScript) and webmail (Next.js), a local
docker-compose.yaml wiring all services together, a language-enforcement
lint script, and a GitHub Actions CI workflow.

Built via 11 sequential tasks under subagent-driven development, each with
an independent implementer + reviewer cycle. Fixes applied during review:
DomainName.IsPunycode() added to satisfy the promised interface; ioredis
default-import typing under NodeNext; next.js bumped 15.0.3->15.5.21 to
resolve high/critical CVEs; lang-lint.mjs corrected to not flag its own
banned-terms list; web service healthcheck added so compose --wait
actually waits on it; webmail Dockerfile's missing public/ directory:
protocols go.mod version aligned with CI's Go 1.22 pin.

Known follow-ups for later phases (not blocking F0): go-arch-lint isn't
wired into CI yet; live docker compose up and migration apply have not
been exercised in this dev environment (no Docker/psql available here)
and will get their first real run in CI, which does have Docker.

services/protocols/internal/domain/event/events.go

@@ -0,0 +1,87 @@
+// Package event contains the domain events listed in PLAN.md section 3.
+// They are persisted through the transactional outbox (section 9.4), never
+// published directly on a bus from inside a write transaction.
+package event
+
+import "github.com/google/uuid"
+
+// DomainEvent is implemented by every domain event.
+type DomainEvent interface {
+	Type() string
+	AggregateID() uuid.UUID
+}
+
+type EmailReceived struct{ MessageAggregateID uuid.UUID }
+
+func (e EmailReceived) Type() string          { return "EmailReceived" }
+func (e EmailReceived) AggregateID() uuid.UUID { return e.MessageAggregateID }
+
+type EmailAccepted struct{ MessageAggregateID uuid.UUID }
+
+func (e EmailAccepted) Type() string          { return "EmailAccepted" }
+func (e EmailAccepted) AggregateID() uuid.UUID { return e.MessageAggregateID }
+
+type EmailDelivered struct{ JobAggregateID uuid.UUID }
+
+func (e EmailDelivered) Type() string          { return "EmailDelivered" }
+func (e EmailDelivered) AggregateID() uuid.UUID { return e.JobAggregateID }
+
+type EmailDeferred struct{ JobAggregateID uuid.UUID }
+
+func (e EmailDeferred) Type() string          { return "EmailDeferred" }
+func (e EmailDeferred) AggregateID() uuid.UUID { return e.JobAggregateID }
+
+type EmailBounced struct{ JobAggregateID uuid.UUID }
+
+func (e EmailBounced) Type() string          { return "EmailBounced" }
+func (e EmailBounced) AggregateID() uuid.UUID { return e.JobAggregateID }
+
+type MailboxQuotaWarning struct{ MailboxAggregateID uuid.UUID }
+
+func (e MailboxQuotaWarning) Type() string          { return "MailboxQuotaWarning" }
+func (e MailboxQuotaWarning) AggregateID() uuid.UUID { return e.MailboxAggregateID }
+
+type MailboxQuotaExceeded struct{ MailboxAggregateID uuid.UUID }
+
+func (e MailboxQuotaExceeded) Type() string          { return "MailboxQuotaExceeded" }
+func (e MailboxQuotaExceeded) AggregateID() uuid.UUID { return e.MailboxAggregateID }
+
+type SpamDetected struct{ MessageAggregateID uuid.UUID }
+
+func (e SpamDetected) Type() string          { return "SpamDetected" }
+func (e SpamDetected) AggregateID() uuid.UUID { return e.MessageAggregateID }
+
+type VirusDetected struct{ MessageAggregateID uuid.UUID }
+
+func (e VirusDetected) Type() string          { return "VirusDetected" }
+func (e VirusDetected) AggregateID() uuid.UUID { return e.MessageAggregateID }
+
+type DkimRotationStarted struct{ DomainAggregateID uuid.UUID }
+
+func (e DkimRotationStarted) Type() string          { return "DkimRotationStarted" }
+func (e DkimRotationStarted) AggregateID() uuid.UUID { return e.DomainAggregateID }
+
+type DkimRotationCompleted struct{ DomainAggregateID uuid.UUID }
+
+func (e DkimRotationCompleted) Type() string          { return "DkimRotationCompleted" }
+func (e DkimRotationCompleted) AggregateID() uuid.UUID { return e.DomainAggregateID }
+
+type DnsRecordDrifted struct{ DomainAggregateID uuid.UUID }
+
+func (e DnsRecordDrifted) Type() string          { return "DnsRecordDrifted" }
+func (e DnsRecordDrifted) AggregateID() uuid.UUID { return e.DomainAggregateID }
+
+type CertificateRotated struct{ HostAggregateID uuid.UUID }
+
+func (e CertificateRotated) Type() string          { return "CertificateRotated" }
+func (e CertificateRotated) AggregateID() uuid.UUID { return e.HostAggregateID }
+
+type AuthenticationFailed struct{ MailboxAggregateID uuid.UUID }
+
+func (e AuthenticationFailed) Type() string          { return "AuthenticationFailed" }
+func (e AuthenticationFailed) AggregateID() uuid.UUID { return e.MailboxAggregateID }
+
+type RateLimitTriggered struct{ SubjectAggregateID uuid.UUID }
+
+func (e RateLimitTriggered) Type() string          { return "RateLimitTriggered" }
+func (e RateLimitTriggered) AggregateID() uuid.UUID { return e.SubjectAggregateID }

services/protocols/internal/domain/event/events_test.go

@@ -0,0 +1,22 @@
+package event
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+)
+
+func TestEmailReceived_ImplementsDomainEvent(t *testing.T) {
+	id := uuid.New()
+	e := EmailReceived{MessageAggregateID: id}
+	if e.Type() != "EmailReceived" {
+		t.Errorf("Type() = %q, want %q", e.Type(), "EmailReceived")
+	}
+	if e.AggregateID() != id {
+		t.Errorf("AggregateID() = %v, want %v", e.AggregateID(), id)
+	}
+}
+
+func TestEmailBounced_ImplementsDomainEvent(t *testing.T) {
+	var _ DomainEvent = EmailBounced{}
+}