#9 Inbox core: forms, POSTs, storage, ack, license

Context: The only write path. Dumb inbox, private, text-only. Depends on scaffold serve stub. Tasks:

• Forms /new-issue.html, /new-pr.html: free textboxes title + body/prompt, optional handle(<=40)+contact(<=100), honeypot field, license checkbox w/ final text (DRAFT), plain POST to /inbox/issue, /inbox/pr-prompt. No JS.
• hu13 serve --www --inbox-dir --listen: static file server + exactly 2 POST routes. Static serves dist/ with nosniff; POSTs accept urlencoded-only, enforce UTF-8, reject null bytes, strip controls except \n\t, validate caps (title<=300, body<=20000, request<=32KB, license checked else 400), write <uuid4>.json mode 0600 {type,title,body,handle,contact,license_version,received_at,salted_ip_hash(daily salt)}, respond received page with one-time ack uuid + zero reflection.
• hu13 inbox list|show --inbox-dir: escaped plain-text terminal output only.
• Daemon runs unprivileged; no git in PATH needed; writes ONLY inbox dir. Success rubric (dod §Mailbox core):
• curl POSTs (issue + pr-prompt) store one JSON each, 0600, server-named uuid; GET on routes -> 404/405; nothing appears in dist/.
• License unchecked -> 400 nothing stored; checked -> stored version+hash.
• Ack uuid shown once, not in URL; no submitted text echoed in response (grep response for marker string -> absent).
• list|show print text with <script> payload visible as text, no ANSI injection (escape check). Swarm: Platinum (only public write surface in the whole world — treat accordingly). Branch m4/inbox.