issue 1859: move the mail page into internal/web, so the local run can serve it

A program cannot import a main package; the page's code moves to modules/mesh-mail-web/internal/web, and
cmd/mesh-mail-web is a two-line program calling it, so cmd/mail-page-dev (1859.5) serves the same handlers.
Nothing the module does changes.

modules/mesh-mail-web/internal/web/mailwrite.go

@@ -0,0 +1,57 @@
+package web
+
+// Corrections and undo on the mail page (novox/hq ADR 0459 §8, §13; issue 1523): each POST is called only
+// once RequireFormToken (issue 1284, csrf.go) has already let it through — a POST with no token, or
+// another session's, is answered 403 before mail-reading.correct or .undo is ever asked (1523/AC1). Both
+// show the page again once done, exactly as sendHandler (write.go) does for a send.
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"time"
+)
+
+// mailCorrectHandler is POST /mail-correct (1523/AC1): the mail's id, and whatever of mark or group the
+// form carried (both optional; neither given asks mail-reading.correct to refuse, exactly as it already
+// does for nothing to change). A correction that mail-reading itself refuses is not surfaced as an error
+// here — the page is shown again regardless, and simply does not reflect a change that did not happen.
+func (b *Bundle) mailCorrectHandler(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	id, err := strconv.Atoi(r.PostFormValue("id"))
+	if err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	args := map[string]any{"id": float64(id)}
+	if mark := r.PostFormValue("mark"); mark != "" {
+		args["mark"] = mark
+	}
+	if group := r.PostFormValue("group"); group != "" {
+		args["group"] = group
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
+	defer cancel()
+	_, _ = b.mailCorrectAsk(ctx, args)
+	b.accountsPage(w, r)
+}
+
+// mailUndoHandler is POST /mail-undo (1523/AC2): the reading lesson's id.
+func (b *Bundle) mailUndoHandler(w http.ResponseWriter, r *http.Request) {
+	if err := r.ParseForm(); err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	id, err := strconv.Atoi(r.PostFormValue("id"))
+	if err != nil {
+		http.Error(w, "bad request", http.StatusBadRequest)
+		return
+	}
+	ctx, cancel := context.WithTimeout(r.Context(), 20*time.Second)
+	defer cancel()
+	_, _ = b.mailUndoAsk(ctx, map[string]any{"id": float64(id)})
+	b.accountsPage(w, r)
+}