feat(iios): email adapter dedup fix + smoke + verification

Adds adapter-owned externalEventId extraction to the ChannelAdapter contract
(WebhookAdapter→eventId, EmailAdapter→Message-ID) and uses it in InboundService,
so email replays dedup on Message-ID (previously only payload.eventId worked).
Adds an email-dedup spec + smoke-email.mjs proving inbound → normalized, a reply
joins the same email thread, bad signature rejected, and outbound EMAIL SENT.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/adapters/inbound.service.ts

@@ -28,7 +28,8 @@ export class InboundService {
     const { adapter, config } = reg;
 
     const payload = this.safeParse(rawBody);
-    const externalEventId = typeof payload?.eventId === 'string' ? payload.eventId : undefined;
+    // The adapter extracts its provider-native id (eventId, Message-ID, …) for replay dedup.
+    const externalEventId = adapter.externalEventId?.(payload) ?? (typeof payload?.eventId === 'string' ? payload.eventId : undefined);
 
     // Fail-closed: a bad/absent signature is recorded and rejected — never ingested.
     if (!adapter.verifySignature(rawBody, headers, config.secret)) {