Add --read-only server flag

[imdinu]

Problem

v0.3.0 will introduce write operations (flag, move, send). Before that ships, users need a way to opt into read-only mode — especially in enterprise contexts where autonomous agents should not be able to modify email.

Proposed Solution

Add --read-only / -r flag to the serve command:

apple-mail-mcp serve --read-only

When enabled:

• Write tools (update_email_status, move_email, send_email) are not registered with FastMCP
• The server only exposes the 6 read-only tools
• A clear log message confirms read-only mode at startup

Also support via environment variable: APPLE_MAIL_READ_ONLY=true

Why now (v0.2.0, not v0.3.0)?

Ship the flag before the write ops land so that:

1. Users upgrading to v0.3.0 already have the safety valve configured
2. The flag is tested in production before it becomes critical
3. Enterprise users can adopt v0.2.0 knowing the path to v0.3.0 is safe

Source

Gemini review: "Once you add write ops, you need a --read-only flag. Many users will not want an autonomous agent to have the ability to delete their emails."

[imdinu]

Shipped in v0.2.0.