Public inbound ingress plug for mailglass_inbound.
The plug verifies provider requests first, resolves tenant scope second, then normalizes and persists the canonical inbound message without executing any mailbox.
Telemetry + post-commit broadcast
The whole request is wrapped in a [:mailglass_inbound, :ingress, :request, *]
span via MailglassInbound.Telemetry (TELE-01).
After Persist.persist/2 returns {:ok, %{status: :inserted}} — i.e. AFTER the
repo.transact inside Persist.persist/2 has committed — the plug broadcasts a
PII-free {:inbound_record_inserted, record_id, %{provider:, record_type:}}
message on Mailglass.PubSub to the per-tenant topic from
MailglassInbound.PubSub.Topics.inbound_record_inserted/1 (TELE-07, D-45-06,
D-45-07). The broadcast runs OUTSIDE the transaction and never rolls it back:
the committed InboundRecord is the durable source of truth, PubSub is the
realtime fan-out for the Phase 48 admin LiveView. A :duplicate result
broadcasts nothing.