Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/identity/reserved.py

@@ -0,0 +1,50 @@
+"""Reserved localparts that may not be registered (SPEC §4/§6.1).
+
+Mail-grade from day one: role addresses (RFC 2142) plus common admin/system
+handles. Comparison is case-insensitive; keep entries lowercase.
+"""
+
+from __future__ import annotations
+
+RESERVED_LOCALPARTS: frozenset[str] = frozenset(
+    {
+        # RFC 2142 role addresses
+        "postmaster",
+        "abuse",
+        "hostmaster",
+        "webmaster",
+        "usenet",
+        "news",
+        "www",
+        "uucp",
+        "ftp",
+        "noc",
+        "security",
+        "mailer-daemon",
+        # Common system/admin handles
+        "admin",
+        "administrator",
+        "root",
+        "noreply",
+        "no-reply",
+        "donotreply",
+        "do-not-reply",
+        "support",
+        "help",
+        "info",
+        "contact",
+        "sales",
+        "billing",
+        "system",
+        "daemon",
+        "nobody",
+        "null",
+        "void",
+        "test",
+    }
+)
+
+
+def is_reserved(localpart: str) -> bool:
+    """Return True if ``localpart`` is reserved (case-insensitive)."""
+    return localpart.lower() in RESERVED_LOCALPARTS