Normalize every intake path into one event envelope (#283)

Things arrive at Maven from eight directions — a relayed Android
notification on POST /api/ambient, mail candidates from mavmaild, RSS
items, changed pages from the crawler, zenmoney and wg reads from
mavpoll, CalDAV events, presence probes, meeting transcripts and image
descriptions. Each grew its own shape and its own log line, and nothing
could answer "what came in today, from where".

internal/event is that answer: a flat source-agnostic envelope (Source,
Kind, EntityIDs, Title, Body, Priority, OccurredAt, Payload) plus a
bounded in-memory journal. Both are pure — Publish and Normalize take
`now` as a parameter, so no clock read sits on a path a replay would
drive.

Adopting it did not touch eight callers, because every intake path
already converges on three ipc.CoreAPI methods: WriteFact, WriteNote and
CaptureTask. cmd/mavend/intake.go decorates that ONE interface, so
mavweb, mavcaldav, mavpoll, mavmaild and the in-core feed/crawl/capture/
vision workers publish envelopes without knowing events exist. The lone
exception is cmd/mavend/mail.go, which captures through the store
directly and now publishes explicitly.

Nothing dispatches on an event. It is a report that something arrived,
never an instruction to speak — "a feed item appeared" becoming a
notification is the nag this repo refuses. Digestion may read the
journal later; it will still go through internal/loop's rules and the
severity/presence routing table.

Read surface: ipc.MethodRecentEvents (AuthRead, daemon-cached like
TickTrace — a bare store cannot serve a ring) and a read-only /events
page in mavweb.

Production is unchanged when nobody is watching: a nil *event.Bus makes
Publish a no-op and newIntakeAPI returns the wrapped API untouched, so
config.intake_journal < 0 leaves no decorator on the call path at all.
The default is 512 entries; the "off unless configured" rule is for
capabilities that reach out, and a bounded in-memory log of writes core
already performed reaches nowhere.

Verified: make build, make test (go test -race) both clean. New tests
cover the envelope and ring (internal/event, 95.7%), the decorator's
invariants — a failed write publishes nothing, a deduped capture
publishes nothing, OccurredAt is the fact's Ts and not notice time — and
the /events page including escaping of feed-supplied titles.

internal/config/config.go

@@ -169,6 +169,20 @@ type Config struct {
 	// live in the reader (cmd/mavmaild), never here.
 	Email *EmailConfig `json:"email,omitempty"`
 
+	// IntakeJournal — how many entries the unified intake journal keeps
+	// (Vikunja #283): one envelope per thing that arrived, whatever direction it
+	// came from. Absent ⇒ DefaultIntakeJournal. A NEGATIVE value turns the
+	// journal off entirely, and then there is no decorator on the intake path at
+	// all.
+	//
+	// Not gated behind an "off unless configured" block like feeds or telegram,
+	// and the distinction is the one CLAUDE.md draws: that rule exists for
+	// capabilities that reach OUT — a fetch, a send, a third party. This reaches
+	// nowhere. It is a bounded in-memory log of writes core already performed,
+	// it is read only by /events and the simulator, and nothing Maven says
+	// depends on it.
+	IntakeJournal int `json:"intake_journal,omitempty"`
+
 	// Feeds — RSS/Atom feed reading (Vikunja #258). nil / absent ⇒ no feed is
 	// ever fetched: reading the outside world is off unless configured, like
 	// the weather and telegram. See FeedsConfig.
@@ -968,7 +982,11 @@ const (
 	DefaultRepeatInterval   = 5 * time.Minute
 	DefaultAutotuneInterval = 10 * time.Minute
 	DefaultRouterThreshold  = 0.55
-	DefaultQueryMinScore    = 0.55
+	// DefaultIntakeJournal — entries kept in the unified intake journal
+	// (Vikunja #283). A busy day is a few hundred intake writes, so this is
+	// roughly "today and yesterday" at a few hundred KB of memory.
+	DefaultIntakeJournal = 512
+	DefaultQueryMinScore = 0.55
 	// Read off the margin sweep in internal/memory/recalleval on the e5
 	// embedder: 0.008 answers 68% of real questions (down from 72%) and cuts
 	// false recall from 5/5 to 1/5. Every larger delta costs real recall
@@ -1018,6 +1036,9 @@ func Load(path string) (*Config, error) {
 }
 
 func (c *Config) applyDefaults() {
+	if c.IntakeJournal == 0 {
+		c.IntakeJournal = DefaultIntakeJournal
+	}
 	if c.TickInterval == 0 {
 		c.TickInterval = Duration(DefaultTickInterval)
 	}