feat(mail): add governed POP3 legacy import

docs/MAIL_PROTOCOL_ROADMAP.md

@@ -1,12 +1,15 @@
 # Mail Protocol Roadmap
 
-GovOPlaN Mail currently focuses on SMTP sending and IMAP mailbox access. POP3
-and JMAP are deferred until the IMAP mailbox MVP is stable.
+GovOPlaN Mail focuses on SMTP sending and IMAP mailbox access. It also provides
+an explicitly enabled, bounded POP3 legacy-import path. JMAP remains deferred
+until the IMAP mailbox MVP and protocol-neutral mailbox contract are stable.
 
 ## Current Baseline
 
 - SMTP is the send protocol.
 - IMAP is the read/append protocol.
+- POP3 is an optional legacy migration source, never a general mailbox
+  protocol or default profile endpoint.
 - Mail profile policy, encrypted credentials, mailbox folder parsing, test
   buttons, and read-only mailbox UI are built around SMTP and IMAP.
 
@@ -56,17 +59,30 @@ JMAP should be added only after:
 
 ## POP3
 
-POP3 should remain legacy-only.
+POP3 remains legacy-only. The bounded import slice is available when a concrete
+deployment must retire a mailbox that cannot offer IMAP or JMAP.
 
-Add it only when a concrete deployment requires mailbox download from a server
-that cannot offer IMAP or JMAP. POP3 is a poor fit for the normal GovOPlaN
-mailbox UX because it has limited folder, sync, and server-side state semantics.
+It is disabled until an administrator creates a dedicated POP3 endpoint and
+sets `legacy_import_enabled`. The endpoint has its own encrypted credential,
+connection/TLS/authentication diagnostics, maximum message and batch sizes, preview body
+limit, and a separate `allow_delete_after_import` policy. Stable UIDL support is
+mandatory; Mail refuses import when a provider cannot supply it.
 
-If implemented, POP3 should be scoped to explicit download/import workflows, not
-general mailbox browsing.
+Preview and ordinary import are non-destructive. Selected messages become
+encrypted `pending_review` records with a content digest, pinned transport
+revision, source UIDL, and audit evidence. Repeating a UIDL reports a duplicate.
+Provider deletion requires both endpoint policy and `mail:pop3:delete`, is
+chosen separately per batch, and runs only after the local import and its audit
+event commit. A disconnect while POP3 `QUIT` commits deletions becomes
+`outcome_unknown` and is never retried blindly.
+
+POP3 does not supply folder, flag, thread, search, or synchronization semantics.
+It is therefore excluded from the normal mailbox UI and from the recommended
+ongoing Mail profile. Configuration-package export/import remains SMTP-focused;
+legacy source rollout is an explicit operational action.
 
 ## Decision
 
-Do not add POP3 or JMAP now. Stabilize SMTP/IMAP first, design protocol-neutral
-mailbox DTOs, then prefer JMAP for modern servers and reserve POP3 for explicit
-legacy download requirements.
+Keep the implemented POP3 surface limited to governed legacy import. Do not
+expand it into mailbox browsing. Design protocol-neutral mailbox DTOs and
+prefer JMAP for future modern synchronization/search support.