merge: inbound email processing from worktree/ageless-shale

Merge the mail.tm transport and email processing pipeline into main.
- Transport-agnostic email processor with mail.tm polling transport
- POST /mailgate webhook endpoint
- User/queue/ticket resolvers with stub user auto-creation
- Queue mail_alias column for email routing
- Migration renumbered to 0021 to follow main's 0019/0020

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/config.ts

@@ -11,6 +11,12 @@ const configSchema = z.object({
   SMTP_FROM: z.string().default('tessera@localhost'),
   UPLOAD_DIR: z.string().default('./data/uploads'),
   JWT_SECRET: z.string().default('tessera-dev-secret-change-in-production'),
+  // Inbound email
+  MAIL_TRANSPORT: z.enum(['mailtm', 'webhook', 'none']).default('none'),
+  MAILTM_POLL_SECONDS: z.coerce.number().int().positive().default(30),
+  MAILTM_ADDRESS: z.string().optional(),
+  MAILTM_ACCOUNT_ID: z.string().optional(),
+  MAILTM_TOKEN: z.string().optional(),
 });
 
 export const config = configSchema.parse(process.env);