List mailboxes

Whether the mailbox's grant currently authenticates.

The three states the Status column draws, as one filterable value.

DERIVED, never stored: it folds connection_status together with whether last_verified_at holds a stamp. A mailbox nobody has checked since it connected and one checked this morning are different answers to "is this grant still good?", and the ops screen has to be able to ask for either.

Deliberately NOT members of :class:MailboxConnectionStatus. That enum is the stored column type and the value on every mailbox response, and eleven places in the domain compare against CONNECTED by identity. A third member there would put a value on the wire that no row can hold and would silently weaken every one of those checks. Two callers also already send connection_status=connected meaning "not broken" (the send-a-test picker and the notification settings page), and they must keep that meaning.

Which email provider a mailbox connects through.

Only Google Workspace ships so far; every provider is implemented behind providers.EmailProviderBase so Office 365 and IMAP/SMTP can be added later without touching callers.

GOOGLE_WORKSPACE holds a per-mailbox OAuth grant (consent screen, refresh token). GOOGLE_WORKSPACE_DWD holds no grant at all: tokens are minted on demand via domain-wide delegation as the platform service account, so its rows carry an empty refresh_token forever. It is the path imported fleets (e.g. InboxKit) connect through.

Which of a mailbox's days the Mailboxes grid narrows to: its sender's today or yesterday.

The column to order by. connection_status orders by the Status column's three states, disconnected first, then connected, then verified; sender_profile_id by the sender's name, with unassigned mailboxes last. Ties go by address. Leave empty for disconnected first, then by address.