feat(messages): add q filtering across API and clients

[jiashuoz]

Summary

• bind q to list_messages with the v1 fields label, from, subject, and created
• compile filters into parameterized PostgreSQL predicates and pin raw q in pagination cursors
• expose the same parameter through OpenAPI, Python and TypeScript SDKs, CLI, and MCP
• document grammar and UTC date-only semantics, and add an end-to-end conformance case

Semantics

Date-only values represent the entire UTC calendar day: equality uses [start, end), inequality uses the inverse, and ordering compares against the documented day boundary.

has:attachment is deliberately deferred. The current attachment JSON is not an authoritative normalized count for all inbound MIME, so exposing it now would create incorrect filtering semantics. It remains rejected as an unknown field until the required expand/backfill/contract migration is designed.

Validation

• go build ./...
• go test ./internal/filterquery/... ./internal/identity/... ./internal/httpapi/... -count=1 -parallel=1
• make spec-check generate-sdk-check openapi-compat-check
• MCP: 281 tests + build
• CLI: 246 tests + build
• TypeScript SDK: 207 tests + type tests
• Python SDK: 473 passed, 28 skipped + mypy
• e2e harness: 18 unit tests + typecheck
• independent correctness review: approved
• adversarial security/contract review: approved

Stack

PR 2 of 2, stacked on feat/filter-query-language-core. After PR 1 merges, retarget this PR to main.