feat(PROJ-52): Vollständigkeits-Reconciliation (Zähl-Report Mailserver vs. Archiv)

Täglicher Cron-Job (archivmail reconcile) berechnet pro Tenant/Quelle
(SMTP-Journal, IMAP-Konto, POP3-Konto, Datei-Import) archivierte Mail-Zahlen,
für IMAP zusätzlich einen Soll/Ist-Vergleich via UID-Tracking. Abweichungen
über Schwellenwert erzeugen Audit-Log-Warnung. Neue Admin-Dashboard-Kachel
"Vollständigkeits-Check" (letzte 7 Tage, Warn-Badge, CSV-Export).

Schließt die "teilweise erfüllt"-Lücke bei Vollständigkeit im
GoBD/DSGVO-Compliance-Check (VOI-Grundsatz 2).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/api/server.go

@@ -20,6 +20,7 @@ import (
 	ldapcfg "archivmail/internal/ldapconfig"
 	"archivmail/internal/mailer"
 	pop3store "archivmail/internal/pop3"
+	"archivmail/internal/reconciliation"
 	"archivmail/internal/smtpoutconfig"
 	"archivmail/internal/smtpd"
 	"archivmail/internal/storage"
@@ -90,6 +91,8 @@ type Server struct {
 	fqdn                 string // from server.fqdn config (PROJ-28)
 	smtpOutStore         *smtpoutconfig.Store
 	apiKeyMw             *auth.APIKeyMiddleware // PROJ-13: external API auth
+	reconStore           *reconciliation.Store  // PROJ-52: completeness reconciliation
+	reconThresholdPct    int                    // PROJ-52: alert threshold (percent below 7-day avg)
 }
 
 // SetSMTPDaemon wires the SMTP daemon into the API server after construction.
@@ -151,6 +154,14 @@ func (s *Server) SetSMTPOutStore(store *smtpoutconfig.Store) {
 	s.smtpOutStore = store
 }
 
+// SetReconciliation wires the completeness-reconciliation store and the alert
+// threshold (percent below the trailing 7-day average) into the API server
+// (PROJ-52).
+func (s *Server) SetReconciliation(store *reconciliation.Store, thresholdPct int) {
+	s.reconStore = store
+	s.reconThresholdPct = thresholdPct
+}
+
 // New creates and wires up a new API server.
 func New(
 	cfg config.APIConfig,
@@ -222,6 +233,9 @@ func (s *Server) routes() {
 
 	s.mux.HandleFunc("GET /api/admin/system/stats", s.authAdmin(s.handleSystemStats))
 	s.mux.HandleFunc("GET /api/admin/stats/timeseries", s.authAdmin(s.handleMailTimeseries))
+	// PROJ-52: Vollständigkeits-Reconciliation (Dashboard + CSV-Export) — admin, tenant-scoped.
+	s.mux.HandleFunc("GET /api/admin/reconciliation", s.authAdmin(s.handleReconciliation))
+	s.mux.HandleFunc("GET /api/admin/reconciliation/export.csv", s.authAdmin(s.handleReconciliationExport))
 	s.mux.HandleFunc("GET /api/admin/security/audit", s.authAdmin(s.handleSecurityAudit))
 	// SEC-17: Security fix actions require superadmin, not just domain_admin.
 	s.mux.HandleFunc("POST /api/admin/security/fix", s.auth(s.requireRole(userstore.RoleSuperAdmin, s.handleSecurityFix)))