#1: implement F0 foundation - monorepo, migrations, Go domain layer, service skeletons, CI

Stands up the LambdaMail monorepo per PLAN.md's F0 milestone: local dev
scaffolding (.env.example, Makefile, .gitignore excluding PLAN.md/docs/
.superpowers/), the full initial Postgres schema as a golang-migrate
migration, the complete Go domain layer for services/protocols (value
objects, entities, domain events - zero external imports beyond
github.com/google/uuid) with unit tests, health-checked service skeletons
for auth/storage (TypeScript) and webmail (Next.js), a local
docker-compose.yaml wiring all services together, a language-enforcement
lint script, and a GitHub Actions CI workflow.

Built via 11 sequential tasks under subagent-driven development, each with
an independent implementer + reviewer cycle. Fixes applied during review:
DomainName.IsPunycode() added to satisfy the promised interface; ioredis
default-import typing under NodeNext; next.js bumped 15.0.3->15.5.21 to
resolve high/critical CVEs; lang-lint.mjs corrected to not flag its own
banned-terms list; web service healthcheck added so compose --wait
actually waits on it; webmail Dockerfile's missing public/ directory:
protocols go.mod version aligned with CI's Go 1.22 pin.

Known follow-ups for later phases (not blocking F0): go-arch-lint isn't
wired into CI yet; live docker compose up and migration apply have not
been exercised in this dev environment (no Docker/psql available here)
and will get their first real run in CI, which does have Docker.

services/protocols/internal/domain/valueobject/email_address.go

@@ -0,0 +1,44 @@
+// Package valueobject contains the domain's immutable, self-validating value objects.
+// Zero external imports: this is layer 1 of Clean Architecture (see PLAN.md section 3).
+package valueobject
+
+import (
+	"errors"
+	"strings"
+)
+
+// EmailAddress is an RFC 5322 mailbox address, normalized with a lowercased domain.
+type EmailAddress struct {
+	localPart string
+	domain    string
+}
+
+var (
+	ErrEmailMissingAtSign  = errors.New("email address: missing '@' separator")
+	ErrEmailEmptyLocalPart = errors.New("email address: local part must not be empty")
+	ErrEmailEmptyDomain    = errors.New("email address: domain must not be empty")
+	ErrEmailLocalPartTooLong = errors.New("email address: local part exceeds 64 octets (RFC 5321 4.5.3.1.1)")
+)
+
+// NewEmailAddress validates and normalizes raw into an EmailAddress.
+func NewEmailAddress(raw string) (EmailAddress, error) {
+	at := strings.LastIndex(raw, "@")
+	if at < 0 {
+		return EmailAddress{}, ErrEmailMissingAtSign
+	}
+	local, domain := raw[:at], raw[at+1:]
+	if local == "" {
+		return EmailAddress{}, ErrEmailEmptyLocalPart
+	}
+	if len(local) > 64 {
+		return EmailAddress{}, ErrEmailLocalPartTooLong
+	}
+	if domain == "" {
+		return EmailAddress{}, ErrEmailEmptyDomain
+	}
+	return EmailAddress{localPart: local, domain: strings.ToLower(domain)}, nil
+}
+
+func (e EmailAddress) LocalPart() string { return e.localPart }
+func (e EmailAddress) Domain() string    { return e.domain }
+func (e EmailAddress) String() string    { return e.localPart + "@" + e.domain }