refactor(14-01): extract DKV inbox providers into shared inbox/ module

- Move ImapProvider, ExchangeInboxProvider, InboxProvider into apps/api/src/inbox/
- Move InboxConfig/InboxAttachment/InboxEmail into new inbox.types.ts
- dkv.types.ts re-exports the moved types so existing DKV imports keep compiling
- DKV switches import paths to ../inbox/... and imports InboxModule
- Pure move + import-path swap: fetchPdfAttachments and all DKV logic unchanged (D-01/D-02)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/api/src/inbox/inbox-provider.interface.ts

@@ -0,0 +1,32 @@
+import { InboxAttachment, InboxConfig, InboxEmail } from './inbox.types';
+
+// Re-export types for downstream consumers that import from this module
+export type { InboxAttachment, InboxConfig, InboxEmail };
+
+/**
+ * Abstract inbox provider contract — implemented by ImapProvider and
+ * ExchangeInboxProvider. Consumers (DkvService, DkvSchedulerService) depend
+ * only on this interface, not on the concrete implementations.
+ *
+ * Security:
+ * - T-07-03: Implementations MUST NOT log credential values
+ * - InboxConfig carries decrypted credentials — never persist, never serialize
+ */
+export interface InboxProvider {
+  /**
+   * Connects to the configured inbox, searches for emails from the configured
+   * sender filter, downloads PDF attachments, and returns all matching emails.
+   *
+   * @param config  Decrypted inbox connection parameters
+   * @returns       Array of emails with their PDF attachments as Buffers
+   */
+  fetchPdfAttachments(config: InboxConfig): Promise<InboxEmail[]>;
+
+  /**
+   * Tests whether the inbox connection can be established.
+   *
+   * @param config  Decrypted inbox connection parameters
+   * @returns       { success: true } on success, { success: false, message } on failure
+   */
+  testConnection(config: InboxConfig): Promise<{ success: boolean; message?: string }>;
+}