Milestone 1 scaffold: binary skeleton, schema, deploy, Mox spike

- Confirmed core bet via spike/mimecheck: mox/message parses a messy multipart
  message standalone (envelope, MIME tree, attachment, body) with only an
  io.ReaderAt — no mox store/config. Option B is viable.
- cmd/openmail single binary: serve|migrate|smtpd|sender|version subcommands.
- internal/api: chi router, constant-time bearer auth, /healthz, stubbed v0
  AgentMail-shaped routes (501 until core services land).
- internal/store: pgxpool + embedded, idempotent, tracked SQL migrations.
- internal/store/migrations/0001_init.sql: full native schema (pods, inboxes,
  threads, messages, attachments, drafts, api_keys, webhooks, outbox, events,
  domains) with FTS + GIN indexes. Validated end-to-end against Postgres 16.
- deploy/: docker-compose (postgres+minio+openmail+caddy), Caddyfile, DNS.md
  (MX/SPF/DKIM/DMARC/DANE/MTA-STS). Makefile, .gitignore.
- Verified: go vet clean; build OK; health/auth smoke tests; migrate idempotent.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/api/auth.go

@@ -0,0 +1,30 @@
+package api
+
+import (
+	"crypto/subtle"
+	"net/http"
+	"strings"
+)
+
+// bearerAuth is a bootstrap bearer-token gate against the configured admin
+// token. Milestone 1+: replace with DB-backed api_keys lookup (hash compare,
+// per-pod scoping). Until OPENMAIL_ADMIN_TOKEN is set, the API is closed.
+func (s *Server) bearerAuth(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.cfg.AdminToken == "" {
+			writeJSON(w, http.StatusServiceUnavailable, map[string]string{
+				"error":   "auth_unconfigured",
+				"message": "OPENMAIL_ADMIN_TOKEN not set; API is closed",
+			})
+			return
+		}
+		const prefix = "Bearer "
+		h := r.Header.Get("Authorization")
+		if !strings.HasPrefix(h, prefix) ||
+			subtle.ConstantTimeCompare([]byte(strings.TrimPrefix(h, prefix)), []byte(s.cfg.AdminToken)) != 1 {
+			writeJSON(w, http.StatusUnauthorized, map[string]string{"error": "unauthorized"})
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}