feat: expose CC and BCC recipients in message API

[danshapiro]

Summary

• The message_recipients table already stores cc and bcc recipient types from Gmail sync (215K CC rows, 4.5K BCC rows in production), but the API only returned to recipients
• Adds cc and bcc fields to MessageSummary (omitted from JSON when empty)
• Populates them via the existing batchGetRecipients / getRecipients helpers for both list and detail endpoints
• Refactors ListMessages to use batchPopulate (like SearchMessages already does) to avoid duplicating batch-loading logic

Test plan

• All existing tests pass (go test ./internal/store/... ./internal/api/...)
• Verify CC/BCC appears in /api/v1/messages list response for messages with CC recipients
• Verify CC/BCC appears in /api/v1/messages/{id} detail response
• Verify messages without CC/BCC omit the fields (omitempty)

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (c6db1dc)

Verdict: No medium-or-higher findings; the change looks clean.

The reviewed changes consistently appear to safely extend message API responses to include cc and bcc recipients in both single-message and batched retrieval paths, with no concrete correctness or security issues identified.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[roborev-ci]

roborev: Combined Review (4023c2c)

Verdict: No medium-or-higher issues found in this change.

The reviewed changes add cc/bcc recipient exposure to message API responses and update retrieval/test coverage accordingly. Across the combined reviews, no Medium, High, or Critical findings were identified.

Residual note: exposing bcc is an intentional API-surface change, so its sensitivity still depends on the existing authentication/authorization model rather than any new control introduced here.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)

[danshapiro]

Thanks Wes!

…

On Tue, Apr 7, 2026 at 5:33 AM Wes McKinney ***@***.***> wrote: Merged #242 <#242> into main. — Reply to this email directly, view it on GitHub <#242 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AA4PK6R24XX4SIKSYQHL7L34UTYRVAVCNFSM6AAAAACXL3ZIDKVHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMRUGI2TMNRXHEYDAOI> . You are receiving this because you authored the thread.Message ID: ***@***.***>