Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart
  message standalone (envelope, MIME tree, attachment, body) with only an
  io.ReaderAt — no mox store/config. Option B is viable.
- cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands.
- internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0
  AgentMail-shaped routes (501 until core services land).
- internal/store: pgxpool + embedded, idempotent, tracked SQL migrations.
- internal/store/migrations/0001_init.sql: full native schema (pods, inboxes,
  threads, messages, attachments, drafts, api_keys, webhooks, outbox, events,
  domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16.
- deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md
  (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore.
- Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/Caddyfile

@@ -0,0 +1,6 @@
+# Caddy terminates TLS for the OpenMail HTTP API and auto-manages certs.
+# Replace mail.example.com with your domain; Caddy provisions a Let's Encrypt
+# cert automatically on first request.
+mail.example.com {
+	reverse_proxy openmail:8080
+}

deploy/DNS.md

@@ -0,0 +1,49 @@
+# DNS for self-hosting OpenMail
+
+Replace `example.com` with your domain and `<VPS_IP>` with the server's address.
+OpenMail leans on Mox's `dkim`/`spf`/`dmarc`/`dane`/`mtasts` packages, but the
+DNS records below are operational and must be published by you.
+
+## Inbound (receive) — required for milestone 2
+
+```
+; route mail for the domain to this server
+example.com.        MX   10 mail.example.com.
+mail.example.com.   A    <VPS_IP>
+mail.example.com.   AAAA <VPS_IPv6>        ; if available
+
+; reverse DNS (PTR) — set at your VPS provider, must resolve mail.example.com
+<VPS_IP>  ->  mail.example.com
+```
+
+## Outbound (send) — deliverability, milestone 3/5
+
+```
+; SPF — authorize this server to send for the domain
+example.com.   TXT   "v=spf1 ip4:<VPS_IP> -all"
+
+; DKIM — publish the public key for the selector OpenMail signs with
+<selector>._domainkey.example.com.   TXT   "v=DKIM1; k=rsa; p=<BASE64_PUBLIC_KEY>"
+
+; DMARC — start at quarantine, tighten to reject after monitoring
+_dmarc.example.com.   TXT   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; adkim=s; aspf=s"
+```
+
+## Secure transport — recommended (Mox supports both)
+
+```
+; MTA-STS — publish policy + serve https://mta-sts.example.com/.well-known/mta-sts.txt
+_mta-sts.example.com.   TXT   "v=STSv1; id=20260621000000"
+mta-sts.example.com.    A     <VPS_IP>
+
+; DANE/TLSA — pin the TLS cert for port 25 (requires DNSSEC on the zone)
+_25._tcp.mail.example.com.   TLSA   3 1 1 <SHA256_OF_CERT_SPKI>
+```
+
+## Notes
+
+- Many cloud providers block outbound port 25 by default — confirm your VPS allows
+  it (or request an unblock) before milestone 2/5.
+- DANE/TLSA requires DNSSEC on the zone; skip it if your DNS host lacks DNSSEC and
+  rely on MTA-STS instead.
+- Warm a new sending IP gradually; reputation is the real deliverability cost.

deploy/docker-compose.yml

@@ -0,0 +1,58 @@
+# OpenMail local/self-host stack. See ARCHITECTURE.md §2.
+# `docker compose up` brings up Postgres, MinIO, the openmail binary, and Caddy.
+services:
+  postgres:
+    image: postgres:16-alpine
+    environment:
+      POSTGRES_USER: openmail
+      POSTGRES_PASSWORD: openmail
+      POSTGRES_DB: openmail
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U openmail"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
+  minio:
+    image: minio/minio:latest
+    command: server /data --console-address ":9001"
+    environment:
+      MINIO_ROOT_USER: openmail
+      MINIO_ROOT_PASSWORD: openmail123
+    volumes:
+      - miniodata:/data
+    ports:
+      - "9001:9001" # console (dev only)
+
+  openmail:
+    build: ..
+    command: ["serve"]
+    environment:
+      OPENMAIL_HTTP_ADDR: ":8080"
+      DATABASE_URL: "postgres://openmail:openmail@postgres:5432/openmail?sslmode=disable"
+      OPENMAIL_ADMIN_TOKEN: "dev-change-me"
+      # S3/MinIO wiring lands with milestone 1 object-store client.
+    depends_on:
+      postgres:
+        condition: service_healthy
+    # Inbound :25 (milestone 2) — uncomment when smtpd lands:
+    # ports:
+    #   - "25:25"
+
+  caddy:
+    image: caddy:2-alpine
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddydata:/data
+    depends_on:
+      - openmail
+
+volumes:
+  pgdata:
+  miniodata:
+  caddydata: