Add end-to-end tests for TLS RPT report ingestion and WebSocket event handling

- Implemented tests for ingesting TLS RPT reports from emails and ensuring they are stored correctly in the database.
- Added tests to verify that the same report can be ingested multiple times without duplication.
- Created tests for backfilling reports that were previously delivered to the inbox.
- Developed WebSocket event handling tests to ensure events are correctly routed to subscribers based on mailbox ownership.
- Included tests for the mail API to validate session handling, mailbox isolation, and error mapping.
- Ensured that the API rejects unauthorized requests and handles malformed JSON gracefully.

.gitignore

@@ -34,5 +34,15 @@ Thumbs.db
 
 # TypeScript incremental build cache
 *.tsbuildinfo
-*json
+
+# DMARC and TLS-RPT reports. They arrive by mail, are parsed into the report
+# tables on delivery, and are named for the reporter and the date range: data,
+# never source.
+#
+# The pattern here was "*json" - no dot - which ignored every .json file in the
+# repository. The ones already committed survived only because .gitignore does
+# not apply to tracked files; any new one - another language's messages, a new
+# service's package.json - would have been silently left out of every commit.
 *.json.gz
+*.xml.gz
+*.zip.gz