feat(store): per-account inbound/outbound whitelist CRUD

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/store/whitelist_test.go

@@ -0,0 +1,38 @@
+package store
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestWhitelistAddListRemove(t *testing.T) {
+	s := openTemp(t)
+	_, _ = s.AddAccount(sampleAccount())
+
+	if err := s.AddWhitelist("work", DirIn, "Bob@Example.com"); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+	_ = s.AddWhitelist("work", DirIn, "@trusted.com")
+
+	got, err := s.ListWhitelist("work", DirIn)
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	want := []string{"@trusted.com", "bob@example.com"} // lower-cased, sorted
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("got %v want %v", got, want)
+	}
+
+	// Out list is independent.
+	if out, _ := s.ListWhitelist("work", DirOut); len(out) != 0 {
+		t.Fatalf("out list should be empty, got %v", out)
+	}
+
+	if err := s.RemoveWhitelist("work", DirIn, "bob@example.com"); err != nil {
+		t.Fatalf("remove: %v", err)
+	}
+	got, _ = s.ListWhitelist("work", DirIn)
+	if !reflect.DeepEqual(got, []string{"@trusted.com"}) {
+		t.Fatalf("after remove got %v", got)
+	}
+}