How reports flow from mailbox to dashboard

The pipeline: poll the IMAP mailbox at rua= → decompress the attachment (bounded, to defend against a decompression bomb) → detect whether it's DMARC XML or TLS-RPT JSON → parse it → store it in the database. A successfully processed message is archived (compressed, named by content hash — never by the original filename, which is attacker-controlled) and moved to a "done" mailbox folder; a failure is moved to a "failed" folder for manual review rather than silently dropped.

Re-running ingestion is safe and idempotent — see how duplicate ingestion is prevented.