send: refuse replies no remote recipient host can accept (#36)

Per SPEC §10.3 a host rejects a reply whose parent it has not stored
(code 6). Found live: chain replies to a domain whose copy of the parent
never arrived bounce there with no feedback to the sender. On send of a
draft with pid, verify each remote recipient domain against the parent's
recorded delivery: refuse with 409 (naming the domains and the add-to /
new-thread remedy) when the parent was never addressed to the domain or
every delivery attempt there concluded in rejection. Parents still in
flight pass — sequencing in-flight chains is the host's outbound concern
(fmsgd, tracked separately) — as does the parent's originating domain,
which retains its own outgoing messages.

Co-authored-by: Claude Fable 5 <[email protected]>

Notify participant domains and push recipients_added on add-to (#34)

AddRecipients now records one msg_add_to_notify row per remote
participant domain of the message -- the domains of from and every to
address, excluding domains hosting one of the batch's new recipients
(they learn through normal delivery) and the local domain (this
database is its record) -- so fmsgd delivers the add-to message to
every participant domain per SPEC §10.2, not only the new batch's.

Addresses already added to the message are now rejected up front:
msg_add_to is unique per (msg, addr), so re-adding silently no-opped
and could leave a batch with no recipients, which fmsgd would deliver
as an invalid add-to message. Re-adding an original to recipient stays
allowed (SPEC §10.3 NOTE II).

The websocket hub listens on the new recipients_added channel (fired by
fmsgd's dd.sql when a batch is recorded, whether added locally or
received from a remote host) and pushes the refreshed message to every
connected participant, closing the gap where existing participants got
no realtime signal that recipients were added.

Requires fmsgd's updated dd.sql (msg_add_to_notify table and
recipients_added trigger).

Co-authored-by: Claude Fable 5 <[email protected]>

local delivery fail when address doesn't exist

restructure dirs more modern idomatic go (#25)

added time_read for messages (#17)

rm redundant empty identity check (#9)