修复：收件箱 ListInbox 漏算 to_human 导致人类地址被拼上 workspace/session

根因：用户从收件箱点开邮件看到 。
收件箱路径 GET /me/mail/inbox 走 repo.ListInbox，它的 SQL 只算了
from_human，漏了 to_human（EXISTS users 子查询）—— 于是返回的
mail.to_human 恒为 false，前端 participantAddress 把人类 jianf 当成
Agent 拼成三段地址。

修复：ListInbox SQL 补 to_human 子查询 + Scan 补 &m.ToHuman。
这是 C 部分「人/Agent 区分」遗漏的最后一条路径（其余 mails 读路径
GetMailByID/GetSessionMails/GetSessionMailByID/ListSentBy 均已填）。

验证：GET /me/mail/inbox 返回 to_human: True，前端正确渲染 jianf。

gateway/internal/repo/repo.go

@@ -431,6 +431,7 @@ func ListInbox(ctx context.Context, agentName, status string, limit int) ([]mode
 	             m.cc_list, m.subject, m.body, m.mail_type, COALESCE(m.permission_result,'') AS permission_result,
 	             m.status, m.created_at, s.session_alias, s.workspace,
 	             EXISTS (SELECT 1 FROM users u WHERE u.username = m.from_name) AS from_human,
+	             EXISTS (SELECT 1 FROM users u WHERE u.username = m.to_name) AS to_human,
 	             COALESCE(NULLIF(s.permission_mode, ''), 'workspace') AS permission_mode,
 	             COALESCE(NULLIF(s.permission_enforcement, ''), 'advisory') AS permission_enforcement
 	      FROM mails m
@@ -461,7 +462,7 @@ func ListInbox(ctx context.Context, agentName, status string, limit int) ([]mode
 		if err := rows.Scan(&m.ID, &m.SessionID, &m.ParentMailID,
 			&m.FromName, &m.FromWorkspace, &m.ToName, &m.ToWorkspace,
 			&ccJSON, &m.Subject, &m.Body, &m.MailType, &m.PermResult,
-			&m.Status, &m.CreatedAt, &alias, &m.SessionWorkspace, &m.FromHuman,
+			&m.Status, &m.CreatedAt, &alias, &m.SessionWorkspace, &m.FromHuman, &m.ToHuman,
 			&m.PermissionMode, &m.PermissionEnforcement); err != nil {
 			return nil, err
 		}