feat(mail): add governed JMAP mailbox sync and search

README.md

@@ -4,7 +4,7 @@
 **Repository type:** module (domain).
 <!-- govoplan-repository-type:end -->
 
-GovOPlaN Mail is the mail transport module. It owns reusable SMTP/IMAP profile management, an explicitly enabled legacy POP3 import path, mail profile policy enforcement, mock mail infrastructure, and the mail WebUI package.
+GovOPlaN Mail is the mail transport module. It owns reusable SMTP/IMAP/JMAP profile management, an explicitly enabled legacy POP3 import path, mail profile policy enforcement, mock mail infrastructure, and the mail WebUI package.
 
 ## Ownership
 
@@ -12,7 +12,7 @@ This repository owns:
 
 - backend module manifest `mail`
 - mail permissions such as `mail:profile:read`, `mail:profile:write_own`, `mail:profile:write`, `mail:profile:use`, `mail:profile:test`, and `mail:mailbox:read`
-- SMTP/IMAP profile models, dedicated legacy POP3 sources, policy checks, encrypted credential storage, and profile resolution
+- SMTP/IMAP/JMAP profile models, dedicated legacy POP3 sources, policy checks, encrypted credential storage, and profile resolution
 - SMTP send and IMAP append adapters, including mock transports for development
 - development mock mailbox endpoints used by test-send flows
 - WebUI package `@govoplan/mail-webui` with profile management, policy management, read-only mailbox components, and governed POP3 import
@@ -21,7 +21,7 @@ Core owns auth, tenants, RBAC evaluation, database/session primitives, secret he
 
 Mail publishes `privacy.dsar.mail` for Core's governed data-subject-request
 workflow. It isolates matching mailbox header parties and returns bounded index,
-personal-profile, delivery, reconciliation, bounce, and imported-message metadata. SMTP/IMAP/POP3
+personal-profile, delivery, reconciliation, bounce, and imported-message metadata. SMTP/IMAP/JMAP/POP3
 configuration and credentials, encrypted messages and envelopes, source UIDL
 and folder/UID
 locators, worker and idempotency state, diagnostics, and opaque evidence are
@@ -31,7 +31,7 @@ provider does not perform direct erasure.
 
 ## Profile and credential ownership
 
-Mail profiles are separate governed definitions. Mail owns their SMTP/IMAP
+Mail profiles are separate governed definitions. Mail owns their SMTP/IMAP/JMAP
 endpoints, encrypted credentials, tests, scope, and policy. Consumers such as
 Campaign store only a stable profile identifier and resolve the authorized,
 active profile through `mail.campaign_delivery`; they never copy or override
@@ -87,7 +87,7 @@ closed with guidance to store those credentials on a Mail profile and enable
 inheritance.
 
 Deleting a profile deactivates its non-secret tombstone metadata and scrubs
-both encrypted SMTP and IMAP passwords immediately in the same transaction as
+its encrypted SMTP, IMAP, JMAP, and POP3 credentials immediately in the same transaction as
 a non-secret audit event. Destructive module retirement applies the same rule
 to every remaining profile before any Mail table is dropped; a scrub or audit
 failure blocks retirement.
@@ -144,13 +144,16 @@ Development mailbox routes are registered by the mail module only when the
 core runtime is in `dev` mode and `dev_mailbox_api_enabled` is enabled. Core
 does not contribute these routes directly.
 
-JMAP remains deferred. The explicitly enabled POP3 slice is limited to bounded,
-encrypted, duplicate-safe legacy import; preview and ordinary import are
-non-destructive, while source deletion requires separate endpoint policy,
-permission, confirmation, and audit evidence. The protocol decision is
-documented in [docs/MAIL_PROTOCOL_ROADMAP.md](docs/MAIL_PROTOCOL_ROADMAP.md):
-prefer JMAP for future modern mailbox sync/search and keep POP3 out of normal
-mailbox browsing. The same roadmap records the
+JMAP is available as an opt-in, read-only mailbox transport after the stable
+IMAP baseline. It discovers RFC 8620/8621 capabilities, lists folders,
+performs server-side message search and pagination, reads bounded message
+bodies and attachment metadata, and exposes bounded incremental Email changes.
+IMAP behavior is unchanged, and SMTP remains the send transport. JMAP Session
+and advertised API origins are governed independently and credentials stay in
+Mail's encrypted envelopes. The explicitly enabled POP3 slice remains limited
+to bounded, encrypted, duplicate-safe legacy import. The protocol boundary is
+documented in [docs/MAIL_PROTOCOL_ROADMAP.md](docs/MAIL_PROTOCOL_ROADMAP.md).
+The same roadmap records the
 approved S/MIME-first, OpenPGP-additional message-protection profile and its
 no-silent-downgrade requirement.