refactor(gmail): route controller read paths through IEmailProvider

GmailController now resolves the "gmail" provider from IEmailProviderRegistry and
uses the provider-neutral seam for its read paths — message search (SearchAsync)
and thread listing (ListThreadMessagesAsync) across ImportThread, RelinkThread,
CreateSuggestedJob, RefreshLinkedThreads and the messages endpoint. OAuth
(connect/callback), connection status and Gmail-specific candidate ranking stay
on IGmailOAuthService until they are generalised.

An optional constructor param keeps direct construction (tests) working via a
fallback single-Gmail registry, so the mocked Gmail service is exercised through
GmailProvider. Behaviour is preserved (neutral DTOs mirror the Gmail shapes).

This makes the seam a real consumer and sets up MicrosoftGraphProvider /
ImapProvider / a manual free-text provider to slot in next.

Build clean; backend suite 135/135 green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/ci-deploy.yml

@@ -13,22 +13,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Setup .NET (resilient)
-        shell: bash
-        # actions/setup-dotnet on this single self-hosted runner intermittently
-        # leaves a partial extraction in the shared tool-cache ("tar: Cannot open:
-        # File exists") or corrupts the SDK download. Install into a clean private
-        # dir via dotnet-install.sh and retry once on failure, mirroring the
-        # npm ci / NuGet retries elsewhere in this workflow.
-        run: |
-          install() {
-            curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-            rm -rf "$HOME/.dotnet"
-            bash /tmp/dotnet-install.sh --channel 9.0 --install-dir "$HOME/.dotnet"
-          }
-          install || ( echo "dotnet install failed ($?) — retrying once..." && install )
-          echo "$HOME/.dotnet" >> "$GITHUB_PATH"
-          "$HOME/.dotnet/dotnet" --info
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: '9.0.x'
 
       - name: Setup Node
         uses: actions/setup-node@v4
@@ -51,12 +39,7 @@ jobs:
         run: |
           node -v
           npm -v
-          # npm ci occasionally segfaults on the runner (SIGSEGV/139, a memory/native
-          # flake). Retry once with a clean node_modules before failing the job.
-          npm ci --no-audit --no-fund \
-            || ( echo "npm ci failed ($?) — cleaning node_modules and retrying once..." \
-                 && rm -rf node_modules \
-                 && npm ci --no-audit --no-fund )
+          npm ci --no-audit --no-fund
 
       - name: Test frontend
         working-directory: job-tracker-ui

JobTrackerApi/Dockerfile

@@ -9,14 +9,7 @@ COPY Models/ Models/
 COPY JobTrackerApi/ JobTrackerApi/
 COPY JobTrackerBackend/ JobTrackerBackend/
 
-# Retry once after clearing NuGet caches. Transient download corruption on the
-# build host can trip NU3008 ("package integrity check failed / has changed since
-# it was signed") while restoring a transitive package; clearing the caches and
-# re-downloading resolves it.
-RUN dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false \
-    || ( echo "Publish failed — clearing NuGet caches and retrying once..." \
-         && dotnet nuget locals all --clear \
-         && dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false )
+RUN dotnet publish JobTrackerApi/JobTrackerApi.csproj -c Release -o /app/publish /p:UseAppHost=false
 
 FROM mcr.microsoft.com/dotnet/aspnet:9.0 AS runtime