feat(v1.1.7-email-inbound): webhook receiver + email:receive trigger

Inbound email: a provider POSTs a normalized JSON message to
POST /api/v1/email-inbound/{app_id}/{trigger_id}; the public receiver
verifies the optional HMAC signature, builds a TriggerEvent::Email, and
enqueues an outbox row the dispatcher delivers like any async trigger.
Handlers see ctx.event.email = #{from,to,cc,subject,text,html,
received_at,message_id}.

- migration 0024: widen triggers.kind + outbox.source_kind CHECKs to
  'email'; new email_trigger_details table.
- TriggerKind::Email, TriggerDetails::Email{has_inbound_secret},
  OutboxSourceKind::Email, TriggerEvent::Email; dispatcher routes the
  email row via the generic resolve_trigger path.
- Admin POST /apps/{id}/triggers/email (validate_trigger_target; module
  + cross-app rejection). inbound_secret is stored ENCRYPTED via the
  master key (deviation from the brief's plaintext default; decrypted
  per inbound request — see HANDBACK §7).
- Dashboard: email trigger form on the Triggers tab + webhook URL +
  expected-payload help.
- 8 DB-gated e2e tests (202/401/404/422/cross-app/handler-fire) +
  receiver unit tests (HMAC verify, secret round-trip, payload parse).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dashboard/src/lib/api.ts

@@ -211,7 +211,14 @@ export interface DeadLetterRow {
 	resolution: 'replayed' | 'ignored' | 'handled_by_script' | 'handler_failed' | null;
 }
 
-export type TriggerKind = 'kv' | 'docs' | 'dead_letter' | 'cron' | 'files' | 'pubsub';
+export type TriggerKind =
+	| 'kv'
+	| 'docs'
+	| 'dead_letter'
+	| 'cron'
+	| 'files'
+	| 'pubsub'
+	| 'email';
 export type TriggerDispatchMode = 'sync' | 'async';
 
 /// Per-kind detail, tagged by `kind` to match the Rust serde shape.
@@ -221,7 +228,15 @@ export type TriggerDetails =
 	| { kind: 'dead_letter'; source_filter?: string; trigger_id_filter?: string; script_id_filter?: string }
 	| { kind: 'cron'; schedule: string; timezone: string; last_fired_at?: string | null }
 	| { kind: 'files'; collection_glob: string; ops: string[] }
-	| { kind: 'pubsub'; topic_pattern: string };
+	| { kind: 'pubsub'; topic_pattern: string }
+	| { kind: 'email'; has_inbound_secret: boolean };
+
+export interface CreateEmailTriggerInput {
+	script_id: string;
+	/// Shared HMAC secret; null/omitted means the receiver accepts
+	/// unsigned POSTs (URL secrecy is then the only guard).
+	inbound_secret?: string | null;
+}
 
 /// v1.1.5 file metadata as the admin files endpoint returns it.
 export interface FileMeta {
@@ -673,6 +688,11 @@ export const api = {
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers/pubsub`,
 				{ method: 'POST', body: JSON.stringify(input) }
 			),
+		createEmail: (idOrSlug: string, input: CreateEmailTriggerInput) =>
+			adminRequest<Trigger>(
+				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers/email`,
+				{ method: 'POST', body: JSON.stringify(input) }
+			),
 		remove: (idOrSlug: string, triggerId: string) =>
 			adminRequest<null>(
 				`/api/v1/admin/apps/${encodeURIComponent(idOrSlug)}/triggers/${triggerId}`,