Add email retention sweep and harden untrusted attachment metadata

[Rowee13]

Summary

Two related changes to the API's email handling.

Email retention. Captured emails were kept forever, so storage grew without bound. A daily job now deletes emails older than EMAIL_RETENTION_DAYS (default 7). Attachment rows cascade with the email, but their files on the mounted volume do not, so the job unlinks those first; a missing file is logged and skipped rather than aborting the sweep.

Scheduling cleanup. The demo cleanup cron drops from every 5 minutes to every 30. The demo TTL is 60 minutes, so cleanup stays timely, while the old interval kept a database connection busy around the clock for a table that is almost always empty. ScheduleModule.forRoot() also moves from DemoModule to AppModule — every cron in the app depended on it being registered inside the demo module, so disabling that module would have silently stopped all scheduled jobs.

Attachment metadata hardening. Attachment filenames and content types come from the MIME headers of inbound mail, which anyone can send to the public SMTP listener, so they are untrusted input:

• Filenames were interpolated directly into the storage path. The timestamp prefix only absorbed the first path segment, so a crafted name could resolve outside the uploads directory. safeAttachmentPath() now keeps only the basename, rejects null bytes, and verifies the result stays within uploadsDir before anything is written.
• The download endpoint reflected the same values into response headers. Content types are constrained to well-formed, non-renderable mime types (falling back to application/octet-stream), the filename is stripped of quotes, backslashes and control characters so it cannot escape the Content-Disposition parameter, and X-Content-Type-Options: nosniff is set.

Testing

• 55/55 tests pass, 24 of them new (attachment-path.spec.ts, attachment-headers.spec.ts, email-retention.service.spec.ts)
• nest build clean
• New and modified files lint clean

Notes

Configuration adds one variable, documented in .env.example:

EMAIL_RETENTION_DAYS=7   # 0 disables the daily retention sweep

Pre-existing prettier errors in src/main.ts and at emails.service.ts:189 are left untouched to keep the diff focused.

🤖 Generated with Claude Code