Fix 13 findings from adversarial milestone-1 review

Blockers in the ingest path (all funnel real mail in milestone 2):
- H1: coerce body bytes to valid UTF-8 (ToValidUTF8) — non-UTF-8/mid-rune cuts
  no longer abort the ingest tx and drop the message.
- H2: EnsurePart's recoverable parse error is non-fatal — proceed with the
  guaranteed-usable Part so messy real-world mail is stored, not rejected.
- H3: extractBodies descends into message/rfc822 (Part.Message via
  SetMessageReaderAt) — forwarded/bounce bodies no longer lost.
- H4: GetMessage/GetThread/GetThreadMessages scoped to inbox_id — no cross-inbox
  access; reply no longer a confused deputy.

Hardening:
- M1: /healthz no longer leaks DB error to unauthenticated callers.
- M2: all DB errors funnel through handleErr; malformed UUID -> 404, dup -> 409,
  internal errors no longer echo the driver string.
- M3: index messages(inbox_id, message_id_hdr) for thread resolution.
- M4: pods UNIQUE(name) + ON CONFLICT (name) — no duplicate default pods.
- L1: skip empty-User/Host addresses (no literal "@").
- L2: skip attachment-disposition parts when picking the body.
- L3: case-insensitive, trimmed 'Re:' detection.

Verified e2e vs Postgres 16: latin1 body stored valid UTF-8; rfc822-only body
extracted; cross-inbox 404; malformed UUID 404; dup 409; threading regression OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/core/message.go

@@ -48,8 +48,11 @@ func scanMessage(row pgx.Row) (Message, error) {
 	return m, err
 }
 
-func (s *Service) GetMessage(ctx context.Context, id string) (Message, error) {
-	m, err := scanMessage(s.pool.QueryRow(ctx, `SELECT `+messageCols+` FROM messages WHERE id = $1`, id))
+// GetMessage is scoped to the inbox: a message id that belongs to another inbox
+// returns ErrNotFound, preventing cross-inbox access.
+func (s *Service) GetMessage(ctx context.Context, inboxID, id string) (Message, error) {
+	m, err := scanMessage(s.pool.QueryRow(ctx,
+		`SELECT `+messageCols+` FROM messages WHERE id = $1 AND inbox_id = $2`, id, inboxID))
 	if errors.Is(err, pgx.ErrNoRows) {
 		return Message{}, ErrNotFound
 	}
@@ -70,9 +73,10 @@ func (s *Service) ListMessages(ctx context.Context, inboxID string, limit int) (
 	return collectMessages(rows)
 }
 
-func (s *Service) GetThreadMessages(ctx context.Context, threadID string) ([]Message, error) {
+func (s *Service) GetThreadMessages(ctx context.Context, inboxID, threadID string) ([]Message, error) {
 	rows, err := s.pool.Query(ctx,
-		`SELECT `+messageCols+` FROM messages WHERE thread_id = $1 ORDER BY created_at ASC`, threadID)
+		`SELECT `+messageCols+` FROM messages WHERE thread_id = $1 AND inbox_id = $2 ORDER BY created_at ASC`,
+		threadID, inboxID)
 	if err != nil {
 		return nil, err
 	}
@@ -164,7 +168,7 @@ func (s *Service) IngestRaw(ctx context.Context, inboxID string, raw []byte) (Me
 	if err := tx.Commit(ctx); err != nil {
 		return Message{}, err
 	}
-	return s.GetMessage(ctx, msgID)
+	return s.GetMessage(ctx, inboxID, msgID)
 }
 
 // resolveThreadTx finds the thread for a message via In-Reply-To/References
@@ -220,10 +224,12 @@ var discardLog = slog.New(slog.NewTextHandler(io.Discard, &slog.HandlerOptions{L
 
 func parseRaw(raw []byte) (parsed, error) {
 	var pr parsed
-	p, err := message.EnsurePart(discardLog, false, bytes.NewReader(raw), int64(len(raw)))
-	if err != nil {
-		return pr, err
-	}
+	// EnsurePart always returns a usable Part — building an octet-stream fallback
+	// even when parsing hits a recoverable defect (bare CR/LF, bad Content-Type,
+	// missing boundary, truncated DSN). That tolerance for messy real-world mail
+	// is precisely why mox was chosen, so we proceed with the returned part and
+	// do NOT treat the recoverable error as fatal.
+	p, _ := message.EnsurePart(discardLog, false, bytes.NewReader(raw), int64(len(raw)))
 	if p.Envelope != nil {
 		e := p.Envelope
 		pr.subject = e.Subject
@@ -246,9 +252,22 @@ func parseRaw(raw []byte) (parsed, error) {
 }
 
 // extractBodies walks the MIME tree and returns the first text/plain and
-// text/html leaf bodies (decoded UTF-8).
+// text/html leaf bodies (coerced to valid UTF-8). It descends into embedded
+// messages and skips attachment parts.
 func extractBodies(p *message.Part) (text, html string) {
+	// Embedded message (message/rfc822 or message/global): the sub-message lives
+	// under p.Message, not p.Parts. Wire its reader, then recurse — otherwise
+	// forwarded mail and DSN/bounce bodies are lost.
+	if p.Message != nil {
+		if err := p.SetMessageReaderAt(); err == nil {
+			return extractBodies(p.Message)
+		}
+		return "", ""
+	}
 	if len(p.Parts) == 0 {
+		if isAttachment(p) {
+			return "", "" // an attachment is not the message body
+		}
 		body := readBody(p)
 		switch {
 		case p.MediaType == "TEXT" && p.MediaSubType == "HTML":
@@ -271,6 +290,16 @@ func extractBodies(p *message.Part) (text, html string) {
 	return text, html
 }
 
+// isAttachment reports whether a part is declared as an attachment (so it is not
+// treated as the message body). Content-Disposition carries params, so we match
+// the leading token.
+func isAttachment(p *message.Part) bool {
+	if p.ContentDisposition == nil {
+		return false
+	}
+	return strings.HasPrefix(strings.ToLower(strings.TrimSpace(*p.ContentDisposition)), "attachment")
+}
+
 const maxBodyBytes = 2 << 20 // 2 MiB cap per body part for milestone 1
 
 func readBody(p *message.Part) string {
@@ -280,19 +309,30 @@ func readBody(p *message.Part) string {
 	}
 	var b strings.Builder
 	_, _ = io.Copy(&b, io.LimitReader(rd, maxBodyBytes))
-	return b.String()
+	// Bodies may be non-UTF-8 (mox returns raw bytes for unknown/empty charsets)
+	// and LimitReader can cut mid-rune; Postgres text/tsvector reject invalid
+	// UTF-8 and would roll back the whole ingest. Coerce to valid UTF-8.
+	return strings.ToValidUTF8(b.String(), "�")
 }
 
+// firstAddr returns the first address that has both a localpart and a host. mox
+// appends empty-User/Host entries for addresses it cannot parse; emitting "@"
+// for those would be wrong, so we skip them.
 func firstAddr(as []message.Address) string {
-	if len(as) == 0 {
-		return ""
+	for _, a := range as {
+		if a.User != "" && a.Host != "" {
+			return a.User + "@" + a.Host
+		}
 	}
-	return as[0].User + "@" + as[0].Host
+	return ""
 }
 
 func addrList(as []message.Address) []string {
 	out := make([]string, 0, len(as))
 	for _, a := range as {
+		if a.User == "" || a.Host == "" {
+			continue
+		}
 		out = append(out, a.User+"@"+a.Host)
 	}
 	return out