Fix 13 findings from adversarial milestone-1 review

Blockers in the ingest path (all funnel real mail in milestone 2):
- H1: coerce body bytes to valid UTF-8 (ToValidUTF8) — non-UTF-8/mid-rune cuts
  no longer abort the ingest tx and drop the message.
- H2: EnsurePart's recoverable parse error is non-fatal — proceed with the
  guaranteed-usable Part so messy real-world mail is stored, not rejected.
- H3: extractBodies descends into message/rfc822 (Part.Message via
  SetMessageReaderAt) — forwarded/bounce bodies no longer lost.
- H4: GetMessage/GetThread/GetThreadMessages scoped to inbox_id — no cross-inbox
  access; reply no longer a confused deputy.

Hardening:
- M1: /healthz no longer leaks DB error to unauthenticated callers.
- M2: all DB errors funnel through handleErr; malformed UUID -> 404, dup -> 409,
  internal errors no longer echo the driver string.
- M3: index messages(inbox_id, message_id_hdr) for thread resolution.
- M4: pods UNIQUE(name) + ON CONFLICT (name) — no duplicate default pods.
- L1: skip empty-User/Host addresses (no literal "@").
- L2: skip attachment-disposition parts when picking the body.
- L3: case-insensitive, trimmed 'Re:' detection.

Verified e2e vs Postgres 16: latin1 body stored valid UTF-8; rfc822-only body
extracted; cross-inbox 404; malformed UUID 404; dup 409; threading regression OK.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/store/migrations/0001_init.sql

@@ -7,7 +7,8 @@ CREATE EXTENSION IF NOT EXISTS pgcrypto;  -- gen_random_uuid()
 CREATE TABLE IF NOT EXISTS pods (
     id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
     name        text NOT NULL,
-    created_at  timestamptz NOT NULL DEFAULT now()
+    created_at  timestamptz NOT NULL DEFAULT now(),
+    UNIQUE (name)
 );
 
 -- Per-domain DKIM keys + DNS verification state.
@@ -142,6 +143,8 @@ CREATE INDEX IF NOT EXISTS idx_inboxes_pod          ON inboxes(pod_id);
 CREATE INDEX IF NOT EXISTS idx_threads_inbox        ON threads(inbox_id);
 CREATE INDEX IF NOT EXISTS idx_messages_thread      ON messages(thread_id);
 CREATE INDEX IF NOT EXISTS idx_messages_inbox_time  ON messages(inbox_id, created_at DESC);
+-- Supports per-delivery thread resolution (message_id_hdr = ANY(...) per inbox).
+CREATE INDEX IF NOT EXISTS idx_messages_msgid       ON messages(inbox_id, message_id_hdr) WHERE message_id_hdr IS NOT NULL;
 CREATE INDEX IF NOT EXISTS idx_messages_ts          ON messages USING gin(ts);
 CREATE INDEX IF NOT EXISTS idx_messages_labels      ON messages USING gin(labels);
 CREATE INDEX IF NOT EXISTS idx_threads_labels       ON threads USING gin(labels);