Thread reads over References and lookup by Message-ID, scoped by a ref (CL-7447)

[TheGreatAxios]

readMailboxThread(db, scope, { ref, cursor?, limit? }) returns the
principal's messages carrying a refs entry equal to ref, oldest first and
keyset-paged on (created_at, id). Each message projects id, messageId,
inReplyTo, references, fromAddress, subject, createdAt, its
read/archived state, and parentId.

Parents come from RFC 5256 References linking, never from subjects.
In-Reply-To first, then the References chain newest-to-oldest; the first
candidate present in this mailbox under this ref wins. An absent ancestor
yields parentId: null rather than a fabricated node. The ancestor lookup
spans the whole ref-scoped set rather than the current page, so a chain
crossing a page boundary cannot report a parent on one page and null on the
next — it costs one extra query per read.

readMailboxMessageByMessageId(db, scope, messageId) looks one message up by
its Message-ID, scoped to (tenantId, principalId), oldest match winning
since a msg-id is the sender's identifier and nothing makes it unique.

Both run on the list projection and never load raw — which is what the
cached threading columns are for.

Migration 0003_mail_references

Adds the cached references column (jsonb, oldest first, NULL rather than
[] for no chain), backfills it from each existing row's frame, and creates
the two indexes below.

The backfill uses the same bytea-level header slicing and NUL stripping
0002 uses — so a body line beginning References: is never mistaken for a
header, and a legacy frame with a NUL byte anywhere cannot abort the UPDATE
(and with it every boot, forever). One thing 0002 did not need: References
folds, so the header section is unfolded before matching; a regex anchored to
one line would have cached only the first fragment and linked older messages
to the wrong ancestor.

EXPLAIN

EXPLAIN (ANALYZE, BUFFERS) on 200 000 inbound rows for one principal spread
across 500 refs (400 rows in the queried ref):

Query	Plan
thread page (ref filter + keyset, LIMIT 51)	Bitmap Index Scan on principal_mail_refs_idx → top-N heapsort, 4.1 ms, 683 buffers
ancestor map (message_id IN (…), ref-scoped)	Index Scan using principal_mail_tenant_id_principal_id_message_id_idx, 0.07 ms, 15 buffers
readMailboxMessageByMessageId	Index Scan using principal_mail_tenant_id_principal_id_message_id_idx, 0.02 ms, 4 buffers

Both new indexes are chosen by the planner; neither read degrades to a
sequential scan.

Tests

src/thread.test.ts (13): two replies with different In-Reply-To resolve to
different parents; References fallback picks the newest present ancestor; a
parent outside the principal's mailbox is null; a parent outside the ref is
null; the refs filter excludes other workbenches; a chain spanning a page
boundary keeps parentId identical to the unpaged read; the projection
carries the threading headers and state; cursor minted for another ref,
malformed cursor and out-of-range limit are all RangeError; msg-id lookup
respects scope. Plus 0003 backfills the References chain, unfolding continuation lines in src/migrations.test.ts, and the DDL-parity check now
canonicalizes the index access method so a GIN index is compared as one.

Full suite 372 pass / 0 fail, typecheck clean, build clean, reference-host
acceptance 20 pass.

Fixes CL-7447
Part of CL-7445