INBOX-0: Gmail request inbox backend (MailKit) + Request entity + sync/triage endpoints

- Request entity (GmailMessageId unique, ThreadId, threading headers, From*, Subject, BodyText,
  ReceivedAt, Status enum-as-string New|InProgress|Assigned|Answered|Abandoned, AssignedContactId? FK,
  DraftReply?, AnsweredAt?). MailSettings singleton (GmailAddress, AppPassword ENCRYPTED via Data
  Protection, PollInterval, Folder, LastUid). Migration AddRequestsAndMailSettings.
- IGmailMailReader (mockable) + MailKit GmailMailReader (imap.gmail.com:993 SSL, envelope+X-GM-THRID
  +body). RequestSyncService: dedup on Message-Id, track LastUid. MailKit 4.17.0.
- Endpoints: POST /api/requests/sync, GET /api/requests (Gridify, filter status), GET /api/requests/{id},
  PUT triage (status+assignedContactId), GET/PUT /api/mail-settings (App Password never returned).
- Tests (in-memory DB + canned reader): sync dedup/idempotency/config-guard, HTTP sync->triage->assign,
  mail-settings secrecy. + gitignore the runtime photo-storage/ dir (god housekeeping).

GerbilManagerWebAPI/Inbox/MailSettingsService.cs

@@ -0,0 +1,43 @@
+using GerbilManagerWebAPI.Models;
+using Microsoft.AspNetCore.DataProtection;
+using Microsoft.EntityFrameworkCore;
+
+namespace GerbilManagerWebAPI.Inbox
+{
+    /// <summary>
+    /// Reads/updates the singleton MailSettings. The Gmail App Password is encrypted at rest
+    /// with ASP.NET Data Protection and is NEVER returned over the wire (only used server-side
+    /// to open the IMAP/SMTP connection).
+    /// </summary>
+    public sealed class MailSettingsService
+    {
+        private readonly ApplicationContext _db;
+        private readonly IDataProtector _protector;
+
+        public MailSettingsService(ApplicationContext db, IDataProtectionProvider dp)
+        {
+            _db = db;
+            _protector = dp.CreateProtector("GerbilManager.MailSettings.AppPassword.v1");
+        }
+
+        public async Task<MailSettings> GetAsync(CancellationToken ct = default)
+        {
+            var s = await _db.MailSettings.FirstOrDefaultAsync(ct);
+            if (s is null)
+            {
+                s = new MailSettings { Id = MailSettings.SingletonId };
+                _db.MailSettings.Add(s);
+                await _db.SaveChangesAsync(ct);
+            }
+            return s;
+        }
+
+        public bool HasAppPassword(MailSettings s) => !string.IsNullOrEmpty(s.AppPasswordProtected);
+
+        public string? DecryptPassword(MailSettings s) =>
+            string.IsNullOrEmpty(s.AppPasswordProtected) ? null : _protector.Unprotect(s.AppPasswordProtected);
+
+        public void SetPassword(MailSettings s, string? plain) =>
+            s.AppPasswordProtected = string.IsNullOrEmpty(plain) ? null : _protector.Protect(plain);
+    }
+}