refactor(ingest): return a domain result from processEmail, map HTTP at the edge

processEmail/validateEmail now return an IngestResult discriminated union
({ ok } | { ok: false; reason }) instead of an HTTP Response. The status mapping
moves to the edge (ingestResultToResponse in forwardemail.ts), and the Cloudflare
email handler now logs the rejection reason instead of silently discarding it.

The ingestion core is transport-agnostic. End-to-end status mapping stays covered
by inbound.test.ts (now incl. 410 expired); email-processor.test asserts on the
domain result directly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/lib/cloudflare-email.ts

@@ -2,6 +2,7 @@ import PostalMime from "postal-mime";
 import { Env } from "../types";
 import { processEmail, RawAttachment } from "./email-processor";
 import { normalizeCid } from "../utils/html-processor";
+import { logger } from "./logger";
 
 export async function handleCloudflareEmail(
   message: ForwardableEmailMessage,
@@ -31,7 +32,7 @@ export async function handleCloudflareEmail(
         contentId: normalizeCid(a.contentId),
       }));
 
-    await processEmail(
+    const result = await processEmail(
       {
         toAddress: message.to,
         from,
@@ -45,6 +46,12 @@ export async function handleCloudflareEmail(
       env,
       ctx,
     );
+    if (!result.ok) {
+      logger.warn("Inbound email rejected", {
+        to: message.to,
+        reason: result.reason,
+      });
+    }
   } catch (error) {
     console.error("Error processing Cloudflare email:", error);
   }