feat(service): P3.3 inbox API + state machine (list/transition, fail-closed, STALE)

InboxService.list (fail-closed) + transition (OPEN/SNOOZED/DONE/STALE/ARCHIVED
state machine, owner-only, state-history). GET /v1/inbox/items + PATCH
/v1/inbox/items/:id. Moved SessionVerifier to global IdentityModule (shared by
message + inbox, no circular imports). 35 tests green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/messaging/message.module.ts

@@ -1,12 +1,11 @@
 import { Module } from '@nestjs/common';
 import { MessageService } from './message.service';
 import { MessageGateway } from './message.gateway';
-import { SessionVerifier } from '../platform/session.verifier';
 import { OutboxModule } from '../outbox/outbox.module';
 
 @Module({
   imports: [OutboxModule],
-  providers: [MessageService, MessageGateway, SessionVerifier],
-  exports: [MessageService, SessionVerifier],
+  providers: [MessageService, MessageGateway],
+  exports: [MessageService],
 })
 export class MessageModule {}