✨ feat(bdd): pkg/bdd/mailpit/ HTTP client + integration tests (ADR-0030 Phase A.2)

Adds the Mailpit HTTP API client used by BDD scenarios to assert on
emails sent during a test. Implements the per-recipient query/await/
purge pattern from ADR-0030.

Build-tag-gated integration tests run against the live Mailpit at
localhost:8025 (started via docker compose up -d mailpit).

Three operations on the client:
- MessagesTo(ctx, to)        — list message IDs for a recipient
- Get(ctx, id)               — fetch full message content (text, html,
                               headers, subject, etc.)
- AwaitMessageTo(ctx, to,    — poll until a message arrives or timeout
   timeout)                    (50ms polls, fail-fast on ctx cancel)
- PurgeMessagesTo(ctx, to)   — delete all messages for a recipient

Tests in client_integration_test.go (build tag `integration`):
- RoundTrip: SMTP submit → list → get → assert subject/text — proves
  the BDD-helper contract end-to-end via real SMTP
- AwaitTimeoutWhenNoMessage: bounded wait when no email arrives
- PurgeIsolation: per-recipient delete does NOT affect other recipients

Mailpit API quirk discovered + documented (Q-NNN candidate):
- /api/v1/messages?query=... is for PAGINATION, not filtering — the
  `query` param there is silently ignored for filtering
- /api/v1/search?query=to:<addr> is the correct endpoint for filtering
  AND the matching DELETE
- ADR-0030 + EMAIL.md updated with the correct endpoint

Run integration tests:
  docker compose up -d mailpit
  go test -tags integration -race ./pkg/bdd/mailpit/...

Out of scope for this PR (Phase A.3+):
- pkg/bdd/steps/email_steps.go BDD step definitions
- magic_link_tokens table + repository
- magic-link/request and magic-link/consume HTTP handlers
- BDD scenarios for the magic-link flow

documentation/EMAIL.md

@@ -43,17 +43,19 @@ http://localhost:8025 — list of all captured messages, search, raw view, HTML
 ### HTTP API (for automation)
 
 ```bash
-# Latest 10 messages
+# Latest 10 messages (no filter — /api/v1/messages is for pagination)
 curl -s 'http://localhost:8025/api/v1/messages?limit=10' | jq
 
-# Messages for a specific recipient (used by BDD tests, cf. ADR-0030)
-curl -s 'http://localhost:8025/api/v1/messages?query=to:test-user@bdd.local' | jq
+# Messages for a specific recipient — use /api/v1/search, NOT /messages
+# (the latter's `query` param is for pagination only, not filtering ;
+# verified empirically 2026-05-05)
+curl -s 'http://localhost:8025/api/v1/search?query=to:test-user@bdd.local' | jq
 
 # Get a specific message by ID (full content, headers, attachments)
 curl -s 'http://localhost:8025/api/v1/message/<id>' | jq
 
-# Purge messages for a recipient (used in test cleanup)
-curl -X DELETE 'http://localhost:8025/api/v1/messages?query=to:test-user@bdd.local'
+# Purge messages for a recipient (used in test cleanup) — also via /search
+curl -X DELETE 'http://localhost:8025/api/v1/search?query=to:test-user@bdd.local'
 ```
 
 Full API: https://mailpit.axllent.org/docs/api-v1/