feat(gmail): Phase 3B — Gmail client (LatestMessageIDs + FetchMessage)

[smallchungus]

Summary

Phase 3B: the Gmail-side I/O the workers need.

• `internal/gmail/token.go` — `LoadToken` / `SaveToken` (encrypted at rest via Phase 3A's oauth helpers) plus `savingSource`, an `oauth2.TokenSource` wrapper that auto-persists refreshed tokens back to Postgres.
• `internal/gmail/client.go` — `New(ctx, Config)` constructs an authenticated `*gmail.Service` (configurable endpoint for tests). `LatestMessageIDs(ctx, lastHistoryID)` walks `Users.History.List` and returns INBOX/PRIMARY message IDs plus the new cursor. `FetchMessage(ctx, id)` returns raw MIME bytes via `Users.Messages.Get(id).Format("raw")`.
• All HTTP exchanges with Gmail mocked via `httptest.Server` — no real Google calls in tests. Manual real-OAuth setup ships in Phase 3F.

3 unit tests + 3 integration tests. Existing 33 tests still green.

Phase 3C (Gotenberg PDF rendering) builds on top.

Test plan

• make lint (0 issues)
• make test-unit
• make test-integration (gmail + 7 other packages all green)
• make k8s-validate
• CI green