References on frames and threading headers in the list projection

[TheGreatAxios]

An inbox page never loads raw — the list projection is deliberately
built from cached columns only — so a client had no way to thread it:
Message-ID and In-Reply-To lived nowhere but inside the frame.

Frame. buildMailFrame accepts references (the thread's ancestry,
oldest first, as RFC 2822 §3.6.4 defines it) and emits it as a folded
References: header inside the 78-character line limit. In-Reply-To
stays the single immediate parent. Every threading value — messageId,
inReplyTo, and each references entry — must be a bracketed msg-id
(<local@domain>), and a RangeError refuses anything else: past the
builder the bytes are frozen, and an unthreadable header written today is
unthreadable forever.

Decode. decodeMailFrame now returns messageId, inReplyTo
(string | null) and references (string[], oldest first) parsed
alongside the header map, so no reader re-derives them.

Projection. principal_mail gains message_id and in_reply_to,
nullable text, cached exactly the way subject and from_address are.
All three durable paths write them — writeMailboxMessage,
deliverInboxItems (both accept inReplyTo and references on their
inputs) and createMailboxPersist, which takes them off the decode of a
frame it did not build. MailboxMessage gains an optional inReplyTo;
messageId now resolves header → cached column → row id, so the row id
is the last resort rather than the list's only answer.

Migration 0002_mail_threading_headers adds both columns and
backfills them from each existing row's raw, so threading does not
silently begin at the upgrade. The backfill searches only the header
section and decodes raw as LATIN1 — a single non-UTF8 byte in one frame
would otherwise abort the whole statement.

Tests: three-deep References round trip and folding, msg-id rejection,
list and detail agreeing on the headers, the persist path caching from an
inbound frame, and the backfill against a table seeded with legacy rows
(raw present, columns null, one of them invalid UTF-8). bun run test,
bun run typecheck, bun run build and the reference-host acceptance
suite are all green locally.

Part of CL-7445
Fixes CL-7446