Add mavmaild, the read-only IMAP poller that feeds mail intake (#246)

The extraction seam landed on the previous branch but nothing fed it. This
adds the daemon that does: every interval it opens one mailbox read-only
(EXAMINE + BODY.PEEK, so reading leaves no \Seen behind), fetches the UIDs
it has not handed over yet, and posts each message to core over
ingest_mail. Core runs the model and writes task candidates; this daemon
writes nothing and cannot create a reminder.

It is a separate daemon because of the credential. mavpoll set the
precedent with the zenmoney token (#125): the module talking to the third
party holds the secret, reads it from a file so it never lands in argv, in
docker-compose.yml or in shell history, and core never sees it. There is
deliberately no -password flag, and a test asserts that.

Off unless configured at both ends: without -password-file the daemon
refuses to start, and if core has no email block the first ingest returns
ErrUnknownMethod, which disables the reader instead of hammering a socket
that will keep refusing. A seen-UID state file (0600, atomic write) keeps a
restart from re-extracting the whole lookback window; correctness does not
depend on it, since capture dedupes on normalised text. Logs are counts and
UIDs — no subject, sender or body.

Verified with an in-process IMAP server and a fake core: bulk mail is
filtered before core is asked, seen UIDs are not re-fetched, a failed
ingest is retried next poll, ErrUnknownMethod stops at the first message,
and state survives a restart. The live half is untested by design — no IMAP
credential exists on this box; setup is written up as QA steps.

Vikunja #246

internal/email/fetch.go

@@ -26,21 +26,23 @@ type FetchSince struct {
 	Since   time.Time
 	Max     int
 	Skip    func(uid uint32) bool
-
-	// dial is the connection seam. nil means Dial (implicit TLS); the tests set
-	// it to an in-process fake. Unexported so no configuration path can point
-	// the reader at a non-TLS transport.
-	dial func(addr string, timeout time.Duration) (*Conn, error)
 }
 
 // Run performs one read. password is passed here, not stored in the struct, so
 // the configuration of a mailbox and the secret for it are never the same value
 // sitting in the same place.
 func (f FetchSince) Run(password string) ([]Message, error) {
+	return f.RunWith(password, nil)
+}
+
+// RunWith is Run with an explicit connection function, which is how the reader
+// daemon and the tests substitute an in-process server. nil ⇒ Dial, i.e.
+// implicit TLS with certificate verification; there is no configuration path
+// that reaches this, so no deployment can end up talking cleartext IMAP.
+func (f FetchSince) RunWith(password string, dial func(addr string, timeout time.Duration) (*Conn, error)) ([]Message, error) {
 	if f.Addr == "" || f.User == "" || f.Mailbox == "" {
 		return nil, fmt.Errorf("email: mailbox not configured (addr/user/mailbox)")
 	}
-	dial := f.dial
 	if dial == nil {
 		dial = Dial
 	}

internal/email/fetch_test.go

@@ -21,13 +21,12 @@ func TestFetchSinceRun(t *testing.T) {
 		Since:   time.Date(2026, 7, 30, 0, 0, 0, 0, time.UTC),
 		Max:     2,
 		Skip:    func(uid uint32) bool { return uid == 3 },
-		dial: func(addr string, timeout time.Duration) (*Conn, error) {
-			cli, srv := net.Pipe()
-			go f.serve(t, srv)
-			return NewConn(cli, timeout)
-		},
 	}
-	msgs, err := fs.Run("secret")
+	msgs, err := fs.RunWith("secret", func(addr string, timeout time.Duration) (*Conn, error) {
+		cli, srv := net.Pipe()
+		go f.serve(t, srv)
+		return NewConn(cli, timeout)
+	})
 	if err != nil {
 		t.Fatalf("run: %v", err)
 	}