Take in invitations that arrive by mail

A watched mailbox is a trust boundary this app did not have: anyone who knows
the address can hand the server an iCalendar file. So a mail can do exactly one
thing — create a row in event_invites. No calendar read path touches that
table, and an invitation becomes an event only when a person accepts it.

Routing is by the ATTENDEE address, never the From header, which a sender can
claim freely. Addresses are matched against users.email plus a dedicated table,
so forwarded mail still finds its owner: the invitation names the original
address, not the mailbox it landed in.

An accepted invitation gets a fresh UID; the organiser's goes to external_uid.
LocalEvent.uid is globally unique, so reusing it would let a stranger's mail
collide with an event already there. That case has a test, because it is the
one that would be a real problem.

parse_ics now reads METHOD, SEQUENCE, the organiser address, the ATTENDEE list
and RECURRENCE-ID. All additive — existing callers read the keys they knew.
METHOD sits on the VCALENDAR, so it is read outside the component loop; that is
the only reliable way to tell an invitation from a plain calendar file. A VEVENT
carrying RECURRENCE-ID is skipped rather than applied, since treating one
occurrence as the series would move every other date.

The mailbox job registers only when IMAP_HOST is set: an unconditional job would
log every few minutes that it has nothing to do, and test_scheduler asserts the
exact job set. Credentials come from the environment, which keeps the one secret
that opens a whole mailbox out of a table an endpoint could return.

Replies to the organiser are the next step; accepting and declining work without
them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/scheduler.py

@@ -133,11 +133,24 @@ def refresh_ical_subscriptions(db: Session) -> None:
                 db.rollback()
 
 
+def fetch_mail_invites(db: Session) -> None:
+    """Read the watched mailbox for new invitations."""
+    import mail_invites
+
+    mail_invites.fetch_invites(db)
+
+
 def install_default_jobs() -> None:
     sweep_hours = float(os.environ.get("ATTACHMENT_SWEEP_HOURS", "24"))
     ical_minutes = float(os.environ.get("ICAL_REFRESH_MINUTES", "15"))
     register("attachments.sweep", sweep_hours * 3600, sweep_attachments)
     register("ical.refresh", ical_minutes * 60, refresh_ical_subscriptions)
+    # Only when a mailbox is configured: an unconditional job would log every
+    # few minutes that it has nothing to do, and test_scheduler asserts the
+    # exact job set.
+    if os.environ.get("IMAP_HOST"):
+        poll_minutes = float(os.environ.get("MAIL_POLL_MINUTES", "5"))
+        register("mail.invites", poll_minutes * 60, fetch_mail_invites)
 
 
 @asynccontextmanager