Add end-to-end tests for TLS RPT report ingestion and WebSocket event handling

- Implemented tests for ingesting TLS RPT reports from emails and ensuring they are stored correctly in the database.
- Added tests to verify that the same report can be ingested multiple times without duplication.
- Created tests for backfilling reports that were previously delivered to the inbox.
- Developed WebSocket event handling tests to ensure events are correctly routed to subscribers based on mailbox ownership.
- Included tests for the mail API to validate session handling, mailbox isolation, and error mapping.
- Ensured that the API rejects unauthorized requests and handles malformed JSON gracefully.

migrations/0008_add_reports_folder.down.sql

@@ -0,0 +1,8 @@
+-- Only removes the folder where it is still empty. A Reports folder holding
+-- delivered reports is data, and dropping it would cascade those messages away.
+DELETE FROM folders f
+ WHERE LOWER(f.name) = 'reports'
+   AND f.special_use IS NULL
+   AND NOT EXISTS (
+     SELECT 1 FROM email_messages e WHERE e.folder_id = f.id
+   );

migrations/0008_add_reports_folder.up.sql

@@ -0,0 +1,17 @@
+-- Give every existing mailbox a Reports folder.
+--
+-- DMARC and TLS-RPT reports are delivered to the dmarc@ and tlsrpt@ aliases
+-- and are now parsed on arrival and filed here rather than into the inbox.
+-- Without the folder the delivery path falls back to INBOX, which is the noise
+-- this is meant to remove.
+--
+-- IMAP defines no special-use role for reports, so the folder is matched by
+-- name and special_use stays NULL.
+INSERT INTO folders (mailbox_id, name, special_use)
+SELECT m.id, 'Reports', NULL
+  FROM mailboxes m
+ WHERE NOT EXISTS (
+   SELECT 1 FROM folders f
+    WHERE f.mailbox_id = m.id
+      AND LOWER(f.name) = 'reports'
+ );

migrations/0009_report_ingestion_idempotency.down.sql

@@ -0,0 +1,2 @@
+DROP INDEX IF EXISTS uq_tls_rpt_reports_org_report;
+DROP INDEX IF EXISTS uq_dmarc_reports_org_report;

migrations/0009_report_ingestion_idempotency.up.sql

@@ -0,0 +1,35 @@
+-- Make storing a report idempotent, keyed on the reporter and their own id
+-- for the report.
+--
+-- Reports used to be written only by hand through the ingest API, so a
+-- duplicate took deliberate effort. They are now parsed automatically out of
+-- the mail that carries them, which makes redelivery routine: an SMTP retry
+-- after a slow commit, or a reporter that simply sends again, would otherwise
+-- store the report a second time and double every number the admin console
+-- shows.
+--
+-- tls_rpt_reports had no unique key at all. dmarc_reports had one over
+-- (domain_id, org_name, report_id), but the ingest path never fills domain_id
+-- and in Postgres a NULL never equals a NULL - so that key did not prevent a
+-- duplicate either.
+
+-- Collapse the duplicates that already accumulated, keeping the earliest row
+-- of each group so the child records that point at it stay valid.
+DELETE FROM tls_rpt_reports a
+ USING tls_rpt_reports b
+ WHERE a.organization_name = b.organization_name
+   AND a.report_id = b.report_id
+   AND (a.created_at, a.id) > (b.created_at, b.id);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_tls_rpt_reports_org_report
+    ON tls_rpt_reports (organization_name, report_id);
+
+DELETE FROM dmarc_reports a
+ USING dmarc_reports b
+ WHERE a.org_name = b.org_name
+   AND a.report_id = b.report_id
+   AND a.domain IS NOT DISTINCT FROM b.domain
+   AND a.id > b.id;
+
+CREATE UNIQUE INDEX IF NOT EXISTS uq_dmarc_reports_org_report
+    ON dmarc_reports (org_name, report_id);