feat(mail): add governed POP3 legacy import

tests/test_dsar_provider.py

@@ -22,6 +22,8 @@ from govoplan_mail.backend.db.models import (
     MailDeliveryCommand,
     MailDeliveryReconciliation,
     MailMailboxMessageIndex,
+    MailPop3Import,
+    MailServerEndpoint,
     MailServerProfile,
 )
 from govoplan_mail.backend.dsar_provider import MAIL_DSAR_CAPABILITY, MailDsarProvider
@@ -71,7 +73,9 @@ class MailDsarProviderTests(unittest.TestCase):
                 ChangeSequenceEntry.__table__,
                 DataSubjectRequest.__table__,
                 MailServerProfile.__table__,
+                MailServerEndpoint.__table__,
                 MailMailboxMessageIndex.__table__,
+                MailPop3Import.__table__,
                 MailDeliveryCommand.__table__,
                 MailDeliveryAttempt.__table__,
                 MailDeliveryReconciliation.__table__,
@@ -160,6 +164,39 @@ class MailDsarProviderTests(unittest.TestCase):
             to_header="subject@example.test",
             indexed_at=now,
         )
+        pop3_server = MailServerEndpoint(
+            id="pop3-server-subject",
+            profile_id=profile.id,
+            tenant_id="tenant-1",
+            protocol="pop3",
+            name="Legacy POP3",
+            config={"host": "pop3-secret-do-not-export"},
+            scope_type="tenant",
+            scope_id="tenant-1",
+        )
+        pop3_import = MailPop3Import(
+            id="pop3-import-subject",
+            tenant_id="tenant-1",
+            profile_id=profile.id,
+            pop3_server_id=pop3_server.id,
+            pop3_credential_id="credential-secret-do-not-export",
+            transport_revision="pop3-revision-secret-do-not-export",
+            provider_uidl="provider-uidl-secret-do-not-export",
+            fingerprint="e" * 64,
+            raw_sha256="f" * 64,
+            raw_message_encrypted="pop3-message-cipher-do-not-export",
+            message_id="pop3-message-id",
+            subject="Imported subject notice",
+            from_header="Legacy office <legacy@example.test>",
+            to_header="Subject Person <subject@example.test>",
+            date="2026-08-19",
+            body_preview="Imported message preview for the subject",
+            size_bytes=84,
+            status="pending_review",
+            imported_at=now,
+            deletion_requested=False,
+            deletion_status="not_requested",
+        )
         command = MailDeliveryCommand(
             id="command-subject",
             tenant_id="tenant-1",
@@ -230,6 +267,8 @@ class MailDsarProviderTests(unittest.TestCase):
                 unrelated,
                 tenant_two_profile,
                 tenant_two,
+                pop3_server,
+                pop3_import,
                 command,
                 attempt,
                 reconciliation,
@@ -264,6 +303,7 @@ class MailDsarProviderTests(unittest.TestCase):
                 "mail_delivery_attempt",
                 "mail_delivery_reconciliation",
                 "mail_bounce_observation",
+                "mail_pop3_import",
             }.issubset({r.resource_type for r in records})
         )
         serialized = repr([record.to_dict() for record in records])
@@ -295,6 +335,11 @@ class MailDsarProviderTests(unittest.TestCase):
             "original-id-do-not-export",
             "bounce-diagnostic-do-not-export",
             "bounce-evidence-do-not-export",
+            "pop3-secret-do-not-export",
+            "credential-secret-do-not-export",
+            "pop3-revision-secret-do-not-export",
+            "provider-uidl-secret-do-not-export",
+            "pop3-message-cipher-do-not-export",
         ):
             self.assertNotIn(hidden, serialized)