Once connected, the morning brief gets an "📧 Urgent inbox" row showing the count + top 3 senders. Family, friends, and personal emails are never shown.

Filter rules (configurable)

• ✅ Last 24h only — older mail invisible.
• ✅ Excluded senders — Līna, family members, kids' school, doctors, anything you tag as personal. Configurable list in telos/state.json under gmail_exclude_senders.
• ✅ Excluded domains — newsletter / marketing / no-reply / @substack.com / @beehiiv.com / common SaaS notification senders (Stripe, Shopify status, Klaviyo no-reply, etc.).
• ✅ Excluded keywords — anything matching "newsletter", "digest", "weekly update", "tracking number", etc.
• ✅ Include if — sender is from your CRM contact list OR subject contains urgency markers (URGENT, ACTION REQUIRED, deadline, invoice, contract, ASAP, payment, legal). Or "starred" / "important" in Gmail.

What gets stored

• 📌 Sender name + first 80 chars of subject only — never the body.
• 📌 No attachments fetched. No threads expanded.
• 📌 Click-through opens Gmail itself in a new tab; the cabinet never displays full message content.

How auth works

Two safe options — both read-only:

1. Gmail App Password + IMAP (recommended) — generate a 16-char app-specific password at myaccount.google.com/apppasswords. Store in /opt/gotauts/.env. Read-only access; revocable any time from your Google account; never grants write/delete capability.
2. Google API OAuth read-only scope — slower setup (Cloud Console project + OAuth consent screen) but eliminates passwords entirely. Overkill for one user.

Both keep the credentials on Hetzner, never in this UI's database. Same trust model as the existing Klaviyo / Shopify integrations.