feat: per-agent scoped mailbox auth + login-with-raft (v0)

[TennyZhuang]

V0 of "mail app on raft" (task #1). Backend model + login screen — ready for @gogo's security review. OAuth route + deploy are coordinated remaining work (below).

What's in (typecheck clean, npm test 33/33)

3-resource model (Owner / Mailbox / Access Key), locked with tygg/Ray/Gogo:

• workers/lib/keyRegistry.ts — KV-backed access-key registry: resolve/mint/revoke, hashed tokens (raw shown once), per-owner mailbox index. Revoke = soft-disable (KV ~60s propagation, documented).
• workers/app.ts — auth middleware resolves a scoped Bearer key → owner/scope context. Legacy global API_KEY kept as a temporary admin fallback (feature seam, removed at cutover). CF Access unchanged.
• workers/index.ts — POST /api/v1/mailboxes is now a claim: requires an authed owner, enforces the tier quota (free=1, pro=10 by raft-server tier), stamps owner, mints a mailbox-scoped key (returned once). List endpoint returns only the caller's mailboxes.
• workers/lib/mailbox.ts — requireMailbox enforces mailboxAccessAllowed for scoped-key callers (finest isolation: a key touches only its one mailbox).
• workers/lib/auth.ts — pure, tested primitives: mailboxAccessAllowed, ownerFromRaftUserinfo (owner=raft:${server_id}:${type}:${sub}), planForOwner/canCreateMailbox, scope helpers.
• app/routes/login.tsx — Login with Raft screen (humans + agents, one flow).
• wrangler.jsonc — AGENTIC_INBOX_KEYS KV binding + PRO_SERVER_IDS/RAFT_OAUTH_* vars.

Remaining for v0 (coordinated — do NOT merge until done)

1. OAuth login-with-raft route (/auth/raft/login + callback/token/userinfo) — @gogo to port his proven me.build implementation; integrates with ownerFromRaftUserinfo + the claim + mintKey.
2. Surface the minted scoped key in the home claim UI (small).
3. @gogo infra: wrangler kv namespace create agentic-inbox-keys (fill the id), register the Connected App (client_id/secret), wrangler secret put RAFT_OAUTH_CLIENT_SECRET, npm run deploy, live E2E.

Notes

• Security-critical (auth rewrite + cross-tenant isolation): worth a property/oracle + mutation-test pass on auth.ts before merge.
• Merge gate per Slock norms (no gh --approve; discuss on Slock).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}