feat(inbound): PostmarkInboundParser + InboundEmailController + DI wiring

[mpge]

Summary

Closes the core inbound-webhook loop for .NET end-to-end, stacked on #23 (router foundation).

• PostmarkInboundParser — normalizes Postmark's JSON webhook payload (FromFull / ToFull / Headers / Attachments) into InboundMessage. Extracts In-Reply-To / References / Message-ID from the Headers array. Decodes base64 attachment content inline.

• InboundEmailController — POST /support/webhook/email/inbound

  • Dispatches to the matching IInboundEmailParser by ?adapter=... query param or X-Escalated-Adapter header
  • Signature-guarded by X-Escalated-Inbound-Secret (constant-time compare via CryptographicOperations.FixedTimeEquals). Uses the same EmailOptions.InboundSecret key that signs Reply-To — symmetric
  • Writes an InboundEmail audit row per request with the resolution outcome (pending → matched | unmatched | failed)
  • Returns 202 Accepted with { inboundId, status, ticketId }

• AddEscalated() wires InboundEmailRouter + PostmarkInboundParser into DI. Additional providers (Mailgun, SES) register by adding their own IInboundEmailParser implementation.

Dependencies

• Stacked on feat(inbound): scaffold InboundMessage + IInboundEmailParser + InboundEmailRouter #23 (feat/inbound-email-webhook — the router foundation). Will rebase onto main once feat(inbound): scaffold InboundMessage + IInboundEmailParser + InboundEmailRouter #23 merges.

Test plan

• 5 parser tests exercise field extraction, threading header parsing, base64 attachment decoding, the minimal-payload path, and the adapter name contract
• Mailgun + SES parsers, attachment persistence, and reply/ticket-create orchestration land in follow-up PRs
• CI green (won't trigger against stacked base until rebased)