refactor(ingest): return a domain result from processEmail, map HTTP at the edge

processEmail/validateEmail now return an IngestResult discriminated union
({ ok } | { ok: false; reason }) instead of an HTTP Response. The status mapping
moves to the edge (ingestResultToResponse in forwardemail.ts), and the Cloudflare
email handler now logs the rejection reason instead of silently discarding it.

The ingestion core is transport-agnostic. End-to-end status mapping stays covered
by inbound.test.ts (now incl. 410 expired); email-processor.test asserts on the
domain result directly.

Co-Authored-By: Claude Opus 4.7 <[email protected]>

src/routes/inbound.test.ts

@@ -135,6 +135,15 @@ describe("POST /api/inbound — handler logic", () => {
     expect(res.status).toBe(403);
   });
 
+  it("returns 410 when the feed has expired", async () => {
+    await env.EMAIL_STORAGE.put(
+      `feed:${VALID_FEED_ID}:config`,
+      JSON.stringify({ expires_at: Date.now() - 1000 }),
+    );
+    const res = await worker.fetch(makeRequest(makePayload()), env);
+    expect(res.status).toBe(410);
+  });
+
   it("returns 200 when sender matches allowlist by exact address", async () => {
     await env.EMAIL_STORAGE.put(
       `feed:${VALID_FEED_ID}:config`,