feat(email): native mailbox provisioning + harden Google sign-in #4072

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/AlecRae.com/pull/59

What

Foundation for native business email (dogfooding info@bookaride.co.nz) + a fix for the deployed Google sign-in 500.

Business email

• mailboxes table — a provisioned business-email address on a hosted, verified domain (distinct from the OAuth-connected external accounts in connected_accounts). Migration 0001_broad_leader.sql.
• Provisioning API POST/GET/DELETE /v1/mailboxes (mounted in server.ts). Create requires the domain to be registered + verified for the account.
• Inbound router now resolves DB-backed provisioned mailboxes to their real id/account before the domain catch-all. (Receiving for any address on a verified domain already worked via the catch-all in router.ts; this makes named mailboxes first-class.)
• Runbook docs/infra/business-email-domain-onboarding.md — exact MX/SPF/DKIM/DMARC records + deliverability steps for a customer domain.

Google sign-in 500 (deployed)

Root-caused: GET /v1/auth/google → signAuthState() throws in prod when JWT_SECRET is unset/<32 chars (password login masked it via ephemeral RS256). Now wrapped to degrade to /login?error=google_unavailable instead of a raw 500. Real fix is env: set a stable JWT_SECRET (≥32 chars) in production (issue #25).

Verification

• Fresh Postgres 16: db:migrate → 137 tables, mailboxes present with all columns ✅
• Schema/migration drift guard green ✅
• apps/api typecheck clean ✅
• Reproduced the Google 500 and confirmed the hardening path ✅

Notes / follow-ups

• Issue #26: services/dns/auto-config.ts still hard-codes .dev placeholder hosts (mx1.alecrae.dev, spf.alecrae.dev) vs .com production — must fix before onboarding a real customer domain.
• This is the spine; next: Google Workspace address import, a business pricing package, per-mailbox inbox UI, and IMAP/JMAP. (Discussion in progress with Craig.)

https://claude.ai/code/session_01McgJLnTbZG9mwhfwd5iAX3

Generated by Claude Code