TW-6481: Add email subscription discovery, unsubscribe, and cleanup

[qasim-nylas]

Summary

Adds a provider-aware email subscription workflow to the CLI using the active/default grant—no grant ID is required.

• nylas email subscriptions list discovers subscriptions from standard List-Unsubscribe headers, groups matching messages, and reports sender, List-ID, message count, last-seen time, and action type.
• nylas email subscriptions unsubscribe <email-or-list-id>... previews and opens reviewed HTTPS or email unsubscribe actions without sending header-controlled requests from the user's mailbox.
• nylas email subscriptions cleanup <email-or-list-id>... separately moves matching messages to Trash or permanently deletes them with --permanent.
• Supports --since, --limit, --all-folders, --dry-run, --yes, and structured output where applicable.

Why

Users currently have to find newsletters individually, unsubscribe manually, and clean up old messages in a separate mail client. TW-6481 introduces a safe CLI-first workflow that works through Nylas grants rather than being Gmail-specific.

User experience and safety

• Uses the configured default grant automatically.
• Defaults to a 90-day, 1,000-message inbox scan; broader scans are explicit.
• Omits postable discussion lists and rejects conflicting unsubscribe destinations.
• Never prints unsubscribe URLs or automatically submits one-click POST requests from untrusted message headers.
• Opens HTTPS actions and mailto: actions for user review using the OS browser/mail composer.
• Keeps cleanup separate from unsubscribe so it can be retried independently.
• Moves mail to Trash by default; permanent deletion is explicit, confirmed, and scans Trash unless --all-folders is provided.
• Validates unsubscribe targets, blocks local/private/numeric-host variants, and uses a non-shell browser launcher on Windows.

Provider support

• Google and Microsoft grants are supported because Nylas exposes the required original headers.
• EWS and IMAP-backed providers are reported as unsupported because the required original headers are not available.
• Gmail permanent deletion requires https://mail.google.com/; Microsoft requires Mail.ReadWrite; Nylas hard delete must also be enabled in the Dashboard.

Implementation notes

• Adds permanent message deletion to the email port and Nylas adapter using hard_delete=true.
• Extends message retrieval with original-header support used by discovery.
• Adds unit, adapter, CLI, and live integration coverage for discovery, selection, validation, unsubscribe actions, cleanup, permanent deletion, output formats, and provider behavior.
• Replaces the reachable golang.org/x/text/cases call in notetaker output with standard-library Unicode capitalization so govulncheck remains clean without adding or upgrading a dependency.

Validation

• make ci-full
  • formatting, vet, and lint
  • unit and race tests
  • security scans and govulncheck (0 findings)
  • build and CLI regression checks
  • agent integration checks
  • full authenticated integration suite
  • test-resource cleanup
• Independent correctness, security, and test reviews completed with no remaining findings.
• Live Google grant workflow validated. Microsoft behavior is unit-covered but was not exercised against a live Microsoft mailbox in this change.

Jira

TW-6481 (Epic: TW-6311)

[AaronDDM]

LGTM 👍