fix: reorder ingress checks and update requirements.md

- Move idempotency before external rules per ADR-0002
- Update requirements.md: new pipeline flow, BLOCKLIST_EMAILS,
  dispatch_context metadata

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/mail/imap.go

@@ -356,7 +356,19 @@ func (w *IMAPWatcher) processMessage(c *imapclient.Client, buf *imapclient.Fetch
 		return
 	}
 
-	// 2. External rules: evaluate operator-configurable policy.
+	// 2. Idempotency: skip if message_id already exists.
+	existing, err := database.FindByMessageID(w.db, messageID)
+	if err != nil {
+		log.Error("imap: db lookup failed", "error", err)
+		return
+	}
+	if existing != nil {
+		log.Info("imap: duplicate message_id, skipping")
+		w.markSeen(c, buf.UID)
+		return
+	}
+
+	// 3. External rules: evaluate operator-configurable policy.
 	ruleResult := w.rules.Evaluate(rules.EmailContext{
 		Sender:    sender,
 		Subject:   subject,
@@ -369,18 +381,6 @@ func (w *IMAPWatcher) processMessage(c *imapclient.Client, buf *imapclient.Fetch
 		return
 	}
 
-	// 3. Idempotency: skip if message_id already exists.
-	existing, err := database.FindByMessageID(w.db, messageID)
-	if err != nil {
-		log.Error("imap: db lookup failed", "error", err)
-		return
-	}
-	if existing != nil {
-		log.Info("imap: duplicate message_id, skipping")
-		w.markSeen(c, buf.UID)
-		return
-	}
-
 	// 4. Threading: determine thread_id.
 	threadID := messageID
 	inReplyTo := ""