Receives inbound emails (from webhooks like AWS SES, SendGrid, etc.), parses them and stores attachments or metadata in the system.

Auth (docs/planning/inbound-relay-hardening.md, item 7): when EMAIL_INBOUND_SECRETS is set, X-Origin-Verify must match one of its values or the request is recorded, alerted and answered 401. The check is deliberately OUTSIDE the try/except below — inside it a 401 becomes a 500, and the Lambda retries 5xx (E6). Ships dark: an empty list never rejects.

Recorded deviation from docs/claude/02-security.md §6 (webhook signatures must be required): nginx already value-compares this header (E9), and a 4xx is TERMINAL for the Lambda (lambda_function.py returns 200 on 4xx, no retry), so an unset or mismatched secret here would stop 100 % of portal leads. Arming is a separate, alarmed step. EMAIL_INBOUND_SECRET (singular) keeps its only documented job — the TOConline origin_verified flag — and is NOT part of the gate, so deploying can never become arming.