INBOX-0: Gmail request inbox backend (MailKit) + Request entity + sync/triage endpoints

- Request entity (GmailMessageId unique, ThreadId, threading headers, From*, Subject, BodyText,
  ReceivedAt, Status enum-as-string New|InProgress|Assigned|Answered|Abandoned, AssignedContactId? FK,
  DraftReply?, AnsweredAt?). MailSettings singleton (GmailAddress, AppPassword ENCRYPTED via Data
  Protection, PollInterval, Folder, LastUid). Migration AddRequestsAndMailSettings.
- IGmailMailReader (mockable) + MailKit GmailMailReader (imap.gmail.com:993 SSL, envelope+X-GM-THRID
  +body). RequestSyncService: dedup on Message-Id, track LastUid. MailKit 4.17.0.
- Endpoints: POST /api/requests/sync, GET /api/requests (Gridify, filter status), GET /api/requests/{id},
  PUT triage (status+assignedContactId), GET/PUT /api/mail-settings (App Password never returned).
- Tests (in-memory DB + canned reader): sync dedup/idempotency/config-guard, HTTP sync->triage->assign,
  mail-settings secrecy. + gitignore the runtime photo-storage/ dir (god housekeeping).

GerbilManagerWebAPI/Inbox/GmailMailReader.cs

@@ -0,0 +1,58 @@
+using MailKit;
+using MailKit.Net.Imap;
+using MailKit.Search;
+using MailKit.Security;
+
+namespace GerbilManagerWebAPI.Inbox
+{
+    /// <summary>
+    /// Live Gmail reader over IMAP (App Password auth). Reads UIDs newer than the last seen,
+    /// fetches envelope + Gmail thread id + the plain-text body. Gated on Julian's App Password
+    /// (tests use a fake IGmailMailReader).
+    /// </summary>
+    public sealed class GmailMailReader : IGmailMailReader
+    {
+        public async Task<IReadOnlyList<MailSummary>> FetchAsync(MailConnection connection, uint sinceUid, CancellationToken ct = default)
+        {
+            using var client = new ImapClient();
+            await client.ConnectAsync("imap.gmail.com", 993, SecureSocketOptions.SslOnConnect, ct);
+            await client.AuthenticateAsync(connection.GmailAddress, connection.AppPassword, ct);
+
+            var folder = string.Equals(connection.Folder, "INBOX", StringComparison.OrdinalIgnoreCase)
+                ? client.Inbox
+                : await client.GetFolderAsync(connection.Folder, ct);
+            await folder.OpenAsync(FolderAccess.ReadOnly, ct);
+
+            var range = new UniqueIdRange(new UniqueId(sinceUid + 1), UniqueId.MaxValue);
+            var uids = await folder.SearchAsync(SearchQuery.Uids(range), ct);
+
+            const MessageSummaryItems items = MessageSummaryItems.Envelope
+                | MessageSummaryItems.UniqueId
+                | MessageSummaryItems.GMailThreadId
+                | MessageSummaryItems.InternalDate;
+            var summaries = await folder.FetchAsync(uids, items, ct);
+
+            var result = new List<MailSummary>();
+            foreach (var s in summaries)
+            {
+                var env = s.Envelope;
+                var msg = await folder.GetMessageAsync(s.UniqueId, ct);   // body + threading headers
+                var from = env?.From?.Mailboxes?.FirstOrDefault();
+                result.Add(new MailSummary(
+                    MessageId: env?.MessageId ?? msg.MessageId ?? "",
+                    ThreadId: s.GMailThreadId?.ToString(),
+                    InReplyTo: msg.InReplyTo,
+                    References: msg.References is { Count: > 0 } ? string.Join(' ', msg.References) : null,
+                    FromAddress: from?.Address ?? "",
+                    FromName: string.IsNullOrWhiteSpace(from?.Name) ? null : from!.Name,
+                    Subject: env?.Subject ?? msg.Subject,
+                    BodyText: msg.TextBody,
+                    ReceivedAt: s.InternalDate ?? env?.Date ?? DateTimeOffset.UtcNow,
+                    Uid: s.UniqueId.Id));
+            }
+
+            await client.DisconnectAsync(true, ct);
+            return result;
+        }
+    }
+}

GerbilManagerWebAPI/Inbox/MailContracts.cs

@@ -0,0 +1,29 @@
+namespace GerbilManagerWebAPI.Inbox
+{
+    /// <summary>Connection params for an IMAP fetch (decrypted password — never persisted/logged).</summary>
+    public sealed record MailConnection(string GmailAddress, string AppPassword, string Folder);
+
+    /// <summary>A fetched email reduced to what the Request entity needs.</summary>
+    public sealed record MailSummary(
+        string MessageId,
+        string? ThreadId,
+        string? InReplyTo,
+        string? References,
+        string FromAddress,
+        string? FromName,
+        string? Subject,
+        string? BodyText,
+        DateTimeOffset ReceivedAt,
+        uint Uid);
+
+    /// <summary>Reads mail from a folder. Abstracted so tests feed canned summaries
+    /// (the live MailKit/Gmail path is gated on Julian's App Password).</summary>
+    public interface IGmailMailReader
+    {
+        /// <summary>Fetch messages with UID &gt; <paramref name="sinceUid"/> from the configured folder.</summary>
+        Task<IReadOnlyList<MailSummary>> FetchAsync(MailConnection connection, uint sinceUid, CancellationToken ct = default);
+    }
+
+    /// <summary>Outcome of a sync run.</summary>
+    public sealed record SyncResult(int Imported, string? Error);
+}

GerbilManagerWebAPI/Inbox/MailSettingsService.cs

@@ -0,0 +1,43 @@
+using GerbilManagerWebAPI.Models;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.EntityFrameworkCore;
+
+namespace GerbilManagerWebAPI.Inbox
+{
+    /// <summary>
+    /// Reads/updates the singleton MailSettings. The Gmail App Password is encrypted at rest
+    /// with ASP.NET Data Protection and is NEVER returned over the wire (only used server-side
+    /// to open the IMAP/SMTP connection).
+    /// </summary>
+    public sealed class MailSettingsService
+    {
+        private readonly ApplicationContext _db;
+        private readonly IDataProtector _protector;
+
+        public MailSettingsService(ApplicationContext db, IDataProtectionProvider dp)
+        {
+            _db = db;
+            _protector = dp.CreateProtector("GerbilManager.MailSettings.AppPassword.v1");
+        }
+
+        public async Task<MailSettings> GetAsync(CancellationToken ct = default)
+        {
+            var s = await _db.MailSettings.FirstOrDefaultAsync(ct);
+            if (s is null)
+            {
+                s = new MailSettings { Id = MailSettings.SingletonId };
+                _db.MailSettings.Add(s);
+                await _db.SaveChangesAsync(ct);
+            }
+            return s;
+        }
+
+        public bool HasAppPassword(MailSettings s) => !string.IsNullOrEmpty(s.AppPasswordProtected);
+
+        public string? DecryptPassword(MailSettings s) =>
+            string.IsNullOrEmpty(s.AppPasswordProtected) ? null : _protector.Unprotect(s.AppPasswordProtected);
+
+        public void SetPassword(MailSettings s, string? plain) =>
+            s.AppPasswordProtected = string.IsNullOrEmpty(plain) ? null : _protector.Protect(plain);
+    }
+}

GerbilManagerWebAPI/Inbox/RequestSyncService.cs

@@ -0,0 +1,69 @@
+using GerbilManagerWebAPI.Models;
+using Microsoft.EntityFrameworkCore;
+
+namespace GerbilManagerWebAPI.Inbox
+{
+    /// <summary>
+    /// Imports Gmail messages into Request rows: dedup on Message-Id, track the highest IMAP
+    /// UID to avoid rescans. The actual fetch is behind <see cref="IGmailMailReader"/> (mockable).
+    /// </summary>
+    public sealed class RequestSyncService
+    {
+        private readonly ApplicationContext _db;
+        private readonly IGmailMailReader _reader;
+        private readonly MailSettingsService _settings;
+
+        public RequestSyncService(ApplicationContext db, IGmailMailReader reader, MailSettingsService settings)
+        {
+            _db = db;
+            _reader = reader;
+            _settings = settings;
+        }
+
+        public async Task<SyncResult> SyncAsync(CancellationToken ct = default)
+        {
+            var settings = await _settings.GetAsync(ct);
+            var password = _settings.DecryptPassword(settings);
+            if (string.IsNullOrWhiteSpace(settings.GmailAddress) || string.IsNullOrWhiteSpace(password))
+                return new SyncResult(0, "MailNotConfigured");
+
+            var conn = new MailConnection(settings.GmailAddress!, password!, settings.Folder);
+            var summaries = await _reader.FetchAsync(conn, settings.LastUid, ct);
+
+            uint maxUid = settings.LastUid;
+            int imported = 0;
+            if (summaries.Count > 0)
+            {
+                var fetchedIds = summaries.Select(s => s.MessageId).Where(id => !string.IsNullOrEmpty(id)).ToList();
+                var existing = (await _db.Requests
+                    .Where(r => fetchedIds.Contains(r.GmailMessageId))
+                    .Select(r => r.GmailMessageId).ToListAsync(ct)).ToHashSet();
+
+                foreach (var m in summaries)
+                {
+                    if (m.Uid > maxUid) maxUid = m.Uid;
+                    if (string.IsNullOrEmpty(m.MessageId) || !existing.Add(m.MessageId)) continue;
+                    _db.Requests.Add(new Request
+                    {
+                        Id = Guid.NewGuid(),
+                        GmailMessageId = m.MessageId,
+                        ThreadId = m.ThreadId,
+                        InReplyToMessageId = m.InReplyTo,
+                        ReferencesHeader = m.References,
+                        FromAddress = m.FromAddress,
+                        FromName = m.FromName,
+                        Subject = m.Subject,
+                        BodyText = m.BodyText,
+                        ReceivedAt = m.ReceivedAt,
+                        Status = RequestStatus.New,
+                    });
+                    imported++;
+                }
+            }
+
+            settings.LastUid = maxUid;
+            await _db.SaveChangesAsync(ct);
+            return new SyncResult(imported, null);
+        }
+    }
+}