Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/identity/schemas.py

@@ -0,0 +1,61 @@
+"""Request/response models for the auth API (SPEC §9.1)."""
+
+from __future__ import annotations
+
+import uuid
+
+from pydantic import BaseModel, Field
+
+
+class RegisterRequest(BaseModel):
+    localpart: str = Field(min_length=3, max_length=30)
+    password: str = Field(min_length=8, max_length=1024)
+    recovery_email: str | None = None
+
+
+class LoginRequest(BaseModel):
+    # Accepts either a bare localpart or the full ``localpart@domain`` handle.
+    handle: str = Field(min_length=1, max_length=320)
+    password: str = Field(min_length=1, max_length=1024)
+    totp: str | None = None  # required when the account has 2FA enabled
+
+
+class TotpSetupResponse(BaseModel):
+    secret: str  # base32, for manual entry
+    provisioning_uri: str  # otpauth:// URI to render as a QR code
+
+
+class TotpEnableRequest(BaseModel):
+    code: str = Field(min_length=6, max_length=10)
+
+
+class TotpDisableRequest(BaseModel):
+    password: str = Field(min_length=1, max_length=1024)
+
+
+class SessionOut(BaseModel):
+    sid: str
+    created: str
+    ua: str
+    current: bool
+
+
+class PasswordResetRequestIn(BaseModel):
+    handle: str = Field(min_length=1, max_length=320)
+
+
+class PasswordResetIn(BaseModel):
+    token: str = Field(min_length=1)
+    password: str = Field(min_length=8, max_length=1024)
+
+
+class UserOut(BaseModel):
+    id: uuid.UUID
+    handle: str
+    recovery_email: str | None
+    settings: dict[str, object]
+    totp_enabled: bool = False
+
+
+class MessageOut(BaseModel):
+    status: str = "ok"