Add AgentMail: paid-member mailbox reader (TUI + bot mode) on the BBS

internal/mailbox is a transport-agnostic mail client for Founding Lifetime
members: read, search, compose, send, reply, flag, delete.

- types/transport/client: paid-gated facade returning JSON-serializable
  structs (same shapes as @logicsrc/plugin-agentmail)
- memory.go: in-memory transport (tests/dev/reference) + tests
- imap.go/smtp.go: real backend — go-imap/v2 (Dovecot IMAP, master-user
  login) + net/smtp submission via the co-located relay; go-message parses
  bodies/attachments
- reader_tui.go: Bubble Tea reader for humans (list/read/flag/delete)
- bot.go: JSON in/out mode for agents (ssh mail@host list|read|send|…)
- wired as the paid "Mail" hub entry and the ssh mail@ route + auth.MailNames

Connects to the self-hosted Mailu stack at mail.profullstack.com /
smtp.profullstack.com. Rebased onto main; build + vet + tests clean (Go 1.26).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/auth/auth.go

@@ -65,6 +65,10 @@ var IRCNames = map[string]bool{"irc": true}
 // via an in-process newsreader. Free for any registered member, like irc@.
 var NewsNames = map[string]bool{"news": true}
 
+// MailNames route a Founding Lifetime (paid) member into the AgentMail client —
+// an interactive TUI with a PTY, or a JSON bot mode with a command/no PTY.
+var MailNames = map[string]bool{"mail": true}
+
 // GameNames are usernames that route to AgentGames: the line-delimited-JSON
 // agent-vs-agent match protocol (PRD §5.2). `play@` stays a guest hub alias.
 var GameNames = map[string]bool{"game": true, "games": true}
@@ -99,6 +103,9 @@ func IsIRCName(u string) bool { return IRCNames[strings.ToLower(u)] }
 // IsNewsName reports whether the SSH username requests the in-BBS newsreader.
 func IsNewsName(u string) bool { return NewsNames[strings.ToLower(u)] }
 
+// IsMailName reports whether the SSH username requests the AgentMail client.
+func IsMailName(u string) bool { return MailNames[strings.ToLower(u)] }
+
 // systemReserved are names that don't drive an SSH route but would still
 // collide with a per-user subdomain (<name>.<host>), the agent route, or common
 // infra hostnames — so members may not claim them as account names.