Gated mail inventory and dry-run

Duckbill™ can inventory folders and produce a dry-run plan. Bulk historical migration is not an MVP execute path.

Rules

InventorySource and AnalyzeFolders are read-only.
CreateMigrationPlan persists a plan with dry_run_required=true and source_delete_allowed=false.
RunDryRun reports selected = succeeded + skipped + duplicate + conflict + failed and keeps the adapter write counter at zero.
POST /api/migrations/start returns POLICY_DENIED while ENABLE_ICLOUD_MIGRATION is off. Pause and resume stay denied with it.
Setting ENABLE_ICLOUD_MIGRATION=true still does not execute bulk migration in this release.

Method	Path	Behavior
`GET`	`/api/inventory/source`	Folder/message inventory against a recorded or mock adapter
`POST`	`/api/inventory/folders/analyze`	Per-folder counts
`POST`	`/api/migrations/plans`	Persist a dry-run-required plan
`POST`	`/api/migrations/dry-run`	Non-mutating estimate
`POST`	`/api/migrations/start`	Always `POLICY_DENIED` in this milestone
`POST`	`/api/migrations/pause`	`POLICY_DENIED`
`POST`	`/api/migrations/resume`	`POLICY_DENIED`

Module	Role
`packages/application/src/inventory.ts`	Inventory and analyze
`packages/application/src/migration.ts`	Plan, dry-run, gated start
`packages/persistence/src/migration-plans.ts`	Plan persistence
`database/migrations/0019_followon_providers.sql`	Plan and dry-run tables