feat(sdk): P3.4 @insignia/iios-inbox-web + kernel-client inbox REST

RestClient.listInboxItems/patchInboxItem + InboxItem type; iios-inbox-web
InboxProvider + useInbox (poll + snooze/done/reopen). Boundary allowlist extended.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-kernel-client/src/rest.ts

@@ -1,5 +1,5 @@
 import type { IngestInteractionRequest } from '@insignia/iios-contracts';
-import type { Message } from './types';
+import type { Message, InboxItem, InboxState } from './types';
 
 export interface RestConfig {
   serviceUrl: string;
@@ -40,6 +40,23 @@ export class RestClient {
     return (await r.json()) as Message;
   }
 
+  async listInboxItems(state?: InboxState): Promise<InboxItem[]> {
+    const q = state ? `?state=${encodeURIComponent(state)}` : '';
+    const r = await fetch(this.url(`/v1/inbox/items${q}`), { headers: this.headers() });
+    if (!r.ok) throw new Error(`listInboxItems ${r.status}`);
+    return (await r.json()) as InboxItem[];
+  }
+
+  async patchInboxItem(id: string, body: { state: InboxState; reason?: string }): Promise<InboxItem> {
+    const r = await fetch(this.url(`/v1/inbox/items/${id}`), {
+      method: 'PATCH',
+      headers: this.headers(),
+      body: JSON.stringify(body),
+    });
+    if (!r.ok) throw new Error(`patchInboxItem ${r.status}`);
+    return (await r.json()) as InboxItem;
+  }
+
   async ingest(body: IngestInteractionRequest, idempotencyKey: string): Promise<unknown> {
     const r = await fetch(this.url('/v1/interactions/ingest'), {
       method: 'POST',