feat(email): add MessageIdUtil for RFC 5322 threading + signed Reply-To

[mpge]

Summary

Ports the NestJS email/message-id.ts helpers to Spring. Pure utility class, no runtime dependencies beyond the JDK's javax.crypto.

API

• buildMessageId(ticketId, replyId, domain) — RFC 5322 Message-ID
  • <ticket-{id}@{domain}> for initial ticket emails
  • <ticket-{id}-reply-{replyId}@{domain}> for agent replies
• parseTicketIdFromMessageId(raw) — extract ticket id from header value (accepts with or without angle brackets)
• buildReplyTo(ticketId, secret, domain) — signed Reply-To of the form reply+{id}.{hmac8}@{domain}
• verifyReplyTo(address, secret) — inbound webhook check; returns ticket id on match

Why signed Reply-To

Even when clients strip our Message-ID / In-Reply-To headers, the Reply-To address still carries ticket identity — the 8-char HMAC-SHA256 prefix prevents forgery.

Scope

Utility only. Follow-up PR will:

1. Wire MessageIdUtil into EmailService.sendEmail (Message-ID + Reply-To headers)
2. Add an EscalatedProperties.Email config block for domain + inboundSecret
3. Add an inbound webhook / controller that calls verifyReplyTo

Test plan

• 13 unit tests covering buildMessageId (initial + reply), parseTicketIdFromMessageId (round-trip + malformed), buildReplyTo (stable, unique per ticket), verifyReplyTo (tamper rejection, wrong secret, local-part-only, case-insensitive hex)
• CI green: test, checkstyle