Phase 28 (Step 1): backend support for race-name mail send

Phase 28's in-game mail UI groups personal threads by the other
party's race. To support that without an extra membership-listing
RPC, the diplomail subsystem now:

- accepts `recipient_race_name` on `POST /messages` and
  `POST /admin` (target=user) as an alternative to
  `recipient_user_id`; the service resolves it via the existing
  `Memberships.ListMembers(gameID, "active")` and rejects with
  `forbidden` when the matching member is no longer active;
- snapshots `diplomail_messages.sender_race_name` at send time for
  every player sender (admin / system rows stay NULL). The UI keys
  per-race threading on this column.

Schema, openapi, README, and a focused e2e test for the new path
(happy path + dual / missing / unknown / kicked errors) land in
this commit; the gateway + UI legs follow in subsequent commits on
this branch.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/internal/postgres/migrations/00001_init.sql

@@ -683,6 +683,11 @@ CREATE TABLE diplomail_messages (
     sender_kind       text        NOT NULL,
     sender_user_id    uuid,
     sender_username   text,
+    -- sender_race_name is the immutable snapshot of the sender's race
+    -- in this game, captured at insert time when sender_kind='player'.
+    -- Admin and system messages carry NULL. The Phase 28 mail UI keys
+    -- per-race threading on this column.
+    sender_race_name  text,
     sender_ip         text        NOT NULL DEFAULT '',
     subject           text        NOT NULL DEFAULT '',
     body              text        NOT NULL,
@@ -698,6 +703,13 @@ CREATE TABLE diplomail_messages (
         (sender_kind = 'admin'  AND sender_user_id IS NULL     AND sender_username IS NOT NULL) OR
         (sender_kind = 'system' AND sender_user_id IS NULL     AND sender_username IS NULL)
     ),
+    -- sender_race_name is only meaningful for player senders. Admin
+    -- and system rows never carry a race; player rows carry one when
+    -- the sender has an active membership at send time (a non-playing
+    -- private-game owner may legitimately have none).
+    CONSTRAINT diplomail_messages_sender_race_chk CHECK (
+        sender_kind = 'player' OR sender_race_name IS NULL
+    ),
     CONSTRAINT diplomail_messages_kind_sender_chk CHECK (
         (kind = 'personal' AND sender_kind = 'player') OR
         (kind = 'admin'    AND sender_kind IN ('player', 'admin', 'system'))