Fix 13 findings from adversarial milestone-1 review

Blockers in the ingest path (all funnel real mail in milestone 2):
- H1: coerce body bytes to valid UTF-8 (ToValidUTF8) — non-UTF-8/mid-rune cuts
  no longer abort the ingest tx and drop the message.
- H2: EnsurePart's recoverable parse error is non-fatal — proceed with the
  guaranteed-usable Part so messy real-world mail is stored, not rejected.
- H3: extractBodies descends into message/rfc822 (Part.Message via
  SetMessageReaderAt) — forwarded/bounce bodies no longer lost.
- H4: GetMessage/GetThread/GetThreadMessages scoped to inbox_id — no cross-inbox
  access; reply no longer a confused deputy.

Hardening:
- M1: /healthz no longer leaks DB error to unauthenticated callers.
- M2: all DB errors funnel through handleErr; malformed UUID -> 404, dup -> 409,
  internal errors no longer echo the driver string.
- M3: index messages(inbox_id, message_id_hdr) for thread resolution.
- M4: pods UNIQUE(name) + ON CONFLICT (name) — no duplicate default pods.
- L1: skip empty-User/Host addresses (no literal "@").
- L2: skip attachment-disposition parts when picking the body.
- L3: case-insensitive, trimmed 'Re:' detection.

Verified e2e vs Postgres 16: latin1 body stored valid UTF-8; rfc822-only body
extracted; cross-inbox 404; malformed UUID 404; dup 409; threading regression OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/api/handlers.go

@@ -6,8 +6,10 @@ import (
 	"io"
 	"net/http"
 	"strconv"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 
 	"github.com/karti-ai/openmail/internal/core"
 	"github.com/karti-ai/openmail/internal/mail"
@@ -28,8 +30,7 @@ func (s *Server) createInbox(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	ib, err := s.core.CreateInbox(r.Context(), s.podID, body.Address, body.DisplayName)
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "create_failed", err.Error())
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusCreated, ib)
@@ -40,8 +41,7 @@ func (s *Server) listInboxes(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	list, err := s.core.ListInboxes(r.Context(), s.podID)
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "list_failed", err.Error())
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"inboxes": list})
@@ -74,8 +74,7 @@ func (s *Server) ingest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	msg, err := s.core.IngestRaw(r.Context(), inboxID, raw)
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "ingest_failed", err.Error())
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusCreated, msg)
@@ -87,8 +86,7 @@ func (s *Server) listMessages(w http.ResponseWriter, r *http.Request) {
 	}
 	limit, _ := strconv.Atoi(r.URL.Query().Get("limit"))
 	list, err := s.core.ListMessages(r.Context(), chi.URLParam(r, "id"), limit)
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "list_failed", err.Error())
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"messages": list})
@@ -98,7 +96,7 @@ func (s *Server) getMessage(w http.ResponseWriter, r *http.Request) {
 	if !s.requireCore(w) {
 		return
 	}
-	m, err := s.core.GetMessage(r.Context(), chi.URLParam(r, "msgID"))
+	m, err := s.core.GetMessage(r.Context(), chi.URLParam(r, "id"), chi.URLParam(r, "msgID"))
 	if handleErr(w, err) {
 		return
 	}
@@ -110,8 +108,7 @@ func (s *Server) listThreads(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	list, err := s.core.ListThreads(r.Context(), chi.URLParam(r, "id"))
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "list_failed", err.Error())
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"threads": list})
@@ -121,14 +118,14 @@ func (s *Server) getThread(w http.ResponseWriter, r *http.Request) {
 	if !s.requireCore(w) {
 		return
 	}
+	inboxID := chi.URLParam(r, "id")
 	threadID := chi.URLParam(r, "threadID")
-	t, err := s.core.GetThread(r.Context(), threadID)
+	t, err := s.core.GetThread(r.Context(), inboxID, threadID)
 	if handleErr(w, err) {
 		return
 	}
-	msgs, err := s.core.GetThreadMessages(r.Context(), threadID)
-	if err != nil {
-		writeErr(w, http.StatusInternalServerError, "list_failed", err.Error())
+	msgs, err := s.core.GetThreadMessages(r.Context(), inboxID, threadID)
+	if handleErr(w, err) {
 		return
 	}
 	writeJSON(w, http.StatusOK, map[string]any{"thread": t, "messages": msgs})
@@ -171,7 +168,7 @@ func (s *Server) replyMessage(w http.ResponseWriter, r *http.Request) {
 	if handleErr(w, err) {
 		return
 	}
-	orig, err := s.core.GetMessage(r.Context(), chi.URLParam(r, "msgID"))
+	orig, err := s.core.GetMessage(r.Context(), inboxID, chi.URLParam(r, "msgID"))
 	if handleErr(w, err) {
 		return
 	}
@@ -215,25 +212,34 @@ func (s *Server) dispatch(w http.ResponseWriter, r *http.Request, out *mail.Outg
 }
 
 func handleErr(w http.ResponseWriter, err error) bool {
+	var pgErr *pgconn.PgError
 	switch {
 	case err == nil:
 		return false
 	case errors.Is(err, core.ErrNotFound):
 		writeErr(w, http.StatusNotFound, "not_found", "resource not found")
+	case errors.As(err, &pgErr) && pgErr.Code == "22P02":
+		// invalid_text_representation, e.g. a malformed UUID in the path — treat
+		// as not found rather than a 500 that echoes the driver error.
+		writeErr(w, http.StatusNotFound, "not_found", "resource not found")
+	case errors.As(err, &pgErr) && pgErr.Code == "23505":
+		// unique_violation, e.g. an inbox address that already exists.
+		writeErr(w, http.StatusConflict, "conflict", "resource already exists")
 	default:
-		writeErr(w, http.StatusInternalServerError, "internal_error", err.Error())
+		writeErr(w, http.StatusInternalServerError, "internal_error", "internal error")
 	}
 	return true
 }
 
 func replySubject(s *string) string {
-	if s == nil || *s == "" {
+	if s == nil || strings.TrimSpace(*s) == "" {
 		return "Re:"
 	}
-	if len(*s) >= 3 && (*s)[:3] == "Re:" {
-		return *s
+	trimmed := strings.TrimSpace(*s)
+	if strings.HasPrefix(strings.ToLower(trimmed), "re:") {
+		return trimmed
 	}
-	return "Re: " + *s
+	return "Re: " + trimmed
 }
 
 func strPtr(s *string) []string {