Add production mail storage and recovery operations to Buddy

[chrisbbreuer]

Goal

Provide repeatable Buddy commands and config for encrypted mail storage, off-host backups, restore drills, key custody, and Sieve forwarding.

Scope

• Status, unlock, lock, externalize, backup, restore-check, and LUKS-header commands.
• Restic repository initialization and scheduled S3 backup management.
• Customer-managed KMS configuration.
• Dedicated Hetzner volume provisioning and capacity checks.
• Compile config/email.ts forwarding declarations to the mail server's canonical format.

Acceptance criteria

• Commands are non-interactive, secret-safe, and produce actionable output.
• No keys appear in argv, environment dumps, logs, or persistent host files.
• Commands are idempotent and covered by tests.
• Production status reports volume, backup age, restore check, key custody, and forwarding state.
• Mail repository issues and commits are cross-linked.

[chrisbbreuer]

Implemented in commit e433ce7 and tracked in draft PR #2201, with the server-side companion in mail-os/mail#8.

Buddy now owns reusable operations for customer-KMS reconciliation, external and recovery LUKS keys, safe keyslot removal, dedicated-volume migration, encrypted Restic configuration, verified restores, Maildir++ migration, and Sieve compilation. Production validation covered migration, a cold reboot/unlock, both key paths, backup/restore checks, KMS metadata, all mail ports, and live socials@ / hi@ forwarding. Pickier and Bun entry-point bundling pass; the existing monorepo isolated-declaration typecheck failures remain, with no errors in commands/mail.ts or the changed cloud IMAP files.