refactor(submission): 重构发件入库的去重流程。

- 将发件消息插入与附件保存改为事务内执行，避免去重键存在但消息缺失时产生脏数据。
- 抽出可注入的数据库执行器，便于在同一事务中复用消息与附件写入逻辑。
- 补充异常场景测试，覆盖“去重键存在但未命中消息”的失败行为。

apps/api/internal/app/app_test.go

@@ -12,6 +12,7 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"encoding/pem"
+	"errors"
 	"io"
 	"log/slog"
 	"math/big"
@@ -1179,6 +1180,46 @@ func TestSubmissionSentCopyDedupesByMessageID(t *testing.T) {
 	}
 }
 
+func TestInsertSentMessageOnceFailsWhenDedupeKeyHasNoMessage(t *testing.T) {
+	a := newTestApp(t)
+	_, mb := defaultAdminUserAndMailbox(t, a)
+	ctx := context.Background()
+	sentFolderID, err := a.ensureFolder(ctx, mb.ID, "Sent")
+	if err != nil {
+		t.Fatal(err)
+	}
+	messageID := "<orphan-sent-dedupe@example.test>"
+	if err := a.insertSentDedupeKey(ctx, mb.ID, sentFolderID, messageID); err != nil {
+		t.Fatal(err)
+	}
+	now := a.now().UTC()
+	sentID, inserted, err := a.insertSentMessageOnce(ctx, storedMessage{
+		MailboxID:  mb.ID,
+		MessageUID: newID("uid"),
+		MessageID:  messageID,
+		Subject:    "orphan dedupe",
+		From:       mb.Address,
+		To:         []string{"person@example.com"},
+		SentAt:     now,
+		ReceivedAt: now,
+		BodyText:   "body",
+		IsRead:     true,
+	}, nil)
+	if !errors.Is(err, errSentDedupeExists) {
+		t.Fatalf("insertSentMessageOnce error=%v, want errSentDedupeExists", err)
+	}
+	if sentID != "" || inserted {
+		t.Fatalf("sentID=%q inserted=%v, want empty false", sentID, inserted)
+	}
+	var count int
+	if err := a.db.QueryRow(`SELECT COUNT(1) FROM messages WHERE mailbox_id=? AND folder_id=? AND message_id=?`, mb.ID, sentFolderID, messageID).Scan(&count); err != nil {
+		t.Fatal(err)
+	}
+	if count != 0 {
+		t.Fatalf("orphan dedupe should not create sent message, count=%d", count)
+	}
+}
+
 func TestSubmissionRequeuesTerminalFailedDuplicateMessageID(t *testing.T) {
 	a := newTestApp(t)
 	a.cfg.SMTPHost = "127.0.0.1"