Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart
  message standalone (envelope, MIME tree, attachment, body) with only an
  io.ReaderAt — no mox store/config. Option B is viable.
- cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands.
- internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0
  AgentMail-shaped routes (501 until core services land).
- internal/store: pgxpool + embedded, idempotent, tracked SQL migrations.
- internal/store/migrations/0001_init.sql: full native schema (pods, inboxes,
  threads, messages, attachments, drafts, api_keys, webhooks, outbox, events,
  domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16.
- deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md
  (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore.
- Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/api/auth.go

@@ -0,0 +1,30 @@
+package api
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+)
+
+// bearerAuth is a bootstrap bearer-token gate against the configured admin
+// token. Milestone 1+: replace with DB-backed api_keys lookup (hash compare,
+// per-pod scoping). Until OPENMAIL_ADMIN_TOKEN is set, the API is closed.
+func (s *Server) bearerAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.cfg.AdminToken == "" {
+			writeJSON(w, http.StatusServiceUnavailable, map[string]string{
+				"error":   "auth_unconfigured",
+				"message": "OPENMAIL_ADMIN_TOKEN not set; API is closed",
+			})
+			return
+		}
+		const prefix = "Bearer "
+		h := r.Header.Get("Authorization")
+		if !strings.HasPrefix(h, prefix) ||
+			subtle.ConstantTimeCompare([]byte(strings.TrimPrefix(h, prefix)), []byte(s.cfg.AdminToken)) != 1 {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}

internal/api/server.go

@@ -0,0 +1,82 @@
+// Package api is OpenMail's agent-facing HTTP surface: the AgentMail-shaped v0
+// REST API (see ARCHITECTURE.md §4). v0 routes are stubbed pending the core
+// services; health and auth are real.
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/go-chi/chi/v5/middleware"
+
+	"github.com/karti-ai/openmail/internal/config"
+	"github.com/karti-ai/openmail/internal/store"
+)
+
+type Server struct {
+	cfg   config.Config
+	store *store.Store
+}
+
+func New(cfg config.Config, st *store.Store) *Server {
+	return &Server{cfg: cfg, store: st}
+}
+
+func (s *Server) Router() http.Handler {
+	r := chi.NewRouter()
+	r.Use(middleware.RequestID)
+	r.Use(middleware.RealIP)
+	r.Use(middleware.Recoverer)
+
+	// Unauthenticated liveness/readiness.
+	r.Get("/healthz", s.handleHealth)
+
+	// Authenticated v0 surface.
+	r.Group(func(r chi.Router) {
+		r.Use(s.bearerAuth)
+
+		r.Route("/v0/inboxes", func(r chi.Router) {
+			r.Post("/", notImplemented)        // create inbox
+			r.Get("/", notImplemented)         // list inboxes
+			r.Get("/{id}", notImplemented)     // get inbox
+			r.Post("/{id}/messages/send", notImplemented)
+			r.Get("/{id}/messages", notImplemented)
+			r.Get("/{id}/messages/{msgID}", notImplemented)
+			r.Post("/{id}/messages/{msgID}/reply", notImplemented)
+			r.Get("/{id}/threads", notImplemented)
+			r.Get("/{id}/threads/{threadID}", notImplemented)
+		})
+	})
+
+	return r
+}
+
+func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
+	status := map[string]any{"status": "ok"}
+	if s.store != nil {
+		if err := s.store.Pool.Ping(r.Context()); err != nil {
+			status["status"] = "degraded"
+			status["db"] = err.Error()
+			writeJSON(w, http.StatusServiceUnavailable, status)
+			return
+		}
+		status["db"] = "ok"
+	} else {
+		status["db"] = "not configured"
+	}
+	writeJSON(w, http.StatusOK, status)
+}
+
+func notImplemented(w http.ResponseWriter, r *http.Request) {
+	writeJSON(w, http.StatusNotImplemented, map[string]string{
+		"error":   "not_implemented",
+		"message": "endpoint scaffolded; core service pending (milestone 1)",
+	})
+}
+
+func writeJSON(w http.ResponseWriter, code int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(code)
+	_ = json.NewEncoder(w).Encode(v)
+}