fix(inbound): accept email replies only from the ticket's requester

[mpge]

Ports escalated-laravel #220 and the updated domain-model/email-threading.md rule.

Change

• InboundEmailRouter: with escalated.email.inbound-secret set, only the signed Reply-To address (reply+{id}.{hmac8}@domain) resolves a ticket. In-Reply-To / References / subject reference are used only when no secret is configured. (The webhook itself already requires the secret, so in practice the signed address is the only link.)
• InboundEmailService: a matched message becomes a reply only when From equals the ticket's requester_email (trimmed, case-insensitive). The reply is posted with the ticket's requester name/email, never the From values, and reopens a RESOLVED/CLOSED ticket. Any other sender (including an agent's address) gets a new ticket; the matched ticket is not modified. Mail is never dropped.
• README inbound section and CHANGELOG updated.

No tenancy layer exists in this port, so none to respect.

Tests

New InboundEmailServiceTest:

• stranger quoting [ESC-…] in the subject -> new ticket, no reply
• stranger threading onto a closed ticket -> new ticket, no status change
• agent address in From with a valid signed Reply-To -> not posted as the agent, new ticket
• requester reply (From in different case) -> reply posted as the requester, ticket reopened
• requester reply to an open ticket -> no status change
• secret set, unsigned recipient with valid headers + subject -> new ticket

InboundEmailRouterTest: headers/subject ignored once a secret is configured; signed Reply-To wins over headers.

The five scenario tests failed on main before the fix.

Local runs

• ./gradlew test (H2): 363 tests, 0 failures, 9 skipped
• ./gradlew checkstyleMain checkstyleTest: no findings in touched files
• PostgreSQL/MySQL legs: left to CI (no schema or query changes; new tests are Mockito unit tests)