INBOX-0: Gmail request inbox backend (MailKit) + Request entity + sync/triage endpoints

- Request entity (GmailMessageId unique, ThreadId, threading headers, From*, Subject, BodyText,
  ReceivedAt, Status enum-as-string New|InProgress|Assigned|Answered|Abandoned, AssignedContactId? FK,
  DraftReply?, AnsweredAt?). MailSettings singleton (GmailAddress, AppPassword ENCRYPTED via Data
  Protection, PollInterval, Folder, LastUid). Migration AddRequestsAndMailSettings.
- IGmailMailReader (mockable) + MailKit GmailMailReader (imap.gmail.com:993 SSL, envelope+X-GM-THRID
  +body). RequestSyncService: dedup on Message-Id, track LastUid. MailKit 4.17.0.
- Endpoints: POST /api/requests/sync, GET /api/requests (Gridify, filter status), GET /api/requests/{id},
  PUT triage (status+assignedContactId), GET/PUT /api/mail-settings (App Password never returned).
- Tests (in-memory DB + canned reader): sync dedup/idempotency/config-guard, HTTP sync->triage->assign,
  mail-settings secrecy. + gitignore the runtime photo-storage/ dir (god housekeeping).

GerbilManagerWebAPI/Program.cs

@@ -42,6 +42,12 @@ builder.Services.AddOptions<GerbilManagerWebAPI.SaleAd.AiOptions>()
 builder.Services.AddHttpClient<GerbilManagerWebAPI.SaleAd.SaleAdService>(
     http => http.Timeout = TimeSpan.FromSeconds(60));
 
+// INBOX-0: Gmail inbox. App Password encrypted at rest via Data Protection.
+builder.Services.AddDataProtection();
+builder.Services.AddScoped<GerbilManagerWebAPI.Inbox.MailSettingsService>();
+builder.Services.AddScoped<GerbilManagerWebAPI.Inbox.IGmailMailReader, GerbilManagerWebAPI.Inbox.GmailMailReader>();
+builder.Services.AddScoped<GerbilManagerWebAPI.Inbox.RequestSyncService>();
+
 var app = builder.Build();
 
 app.MapDefaultEndpoints();
@@ -77,6 +83,7 @@ app.MapContractEndpoints();
 app.MapSettingsEndpoints();
 app.MapExportEndpoints();
 app.MapCmsEndpoints();
+app.MapRequestEndpoints();
 
 app.Run();