Sender avatars, PDF password preview, contacts autosave, account-view + Trash/Spam auto-purge, UI polish

Sender avatars (privacy-safe, server-fetched, cached):
- New GET /api/avatar resolves Gravatar (d=404) then the sender domain's favicon
  under the SSRF guard, Redis-cached (hit+miss); gated by SENDER_AVATARS_ENABLED.
  GuardedResponse gains raw bytes. Shown in the mail list, reading pane, People
  panel, and Contacts (overlay that falls back to initials on a miss).

PDF preview:
- Password-protected PDFs now prompt in-place and retry (pdf.js PasswordException),
  with a clear error for other load failures instead of a blank overlay. The
  password is remembered per attachment until the thread is left; clicking the
  field no longer dismisses the overlay.

Contacts:
- Autosave reply recipients: message.sent now carries to/cc (name+email); the
  contacts plugin subscribes and adds any non-contact recipients to the Autosaved
  group. Contact avatars show the gravatar/favicon via /api/avatar.

Mail views / retention:
- Clicking an account shows all its mail except Trash/Spam (was inbox-only).
- Daily cron autopurge_trash_spam permanently deletes Trash/Spam older than
  TRASH_RETENTION_DAYS (default 30; 0 disables) — server EXPUNGE + local rows.

UI polish:
- Ultimo signet logo in the Mail/Calendar/Contacts sidebar header and collapsed
  rail; consistent 11px top margin and vertically-aligned header row across states
  (fixed-size flex icon buttons); SVG favicon on the browser tab.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

frontend/src/routes/MailLayout.tsx

@@ -509,7 +509,7 @@ export function MailLayout() {
         className="flex shrink-0 flex-col border-r border-app-border bg-app-bg"
       >
         <div
-          className={`flex pb-1 pt-3 ${
+          className={`flex pb-1 pt-[11px] ${
             collapsed ? "flex-col items-center gap-1 px-2" : "items-center justify-between px-3"
           }`}
         >
@@ -526,14 +526,14 @@ export function MailLayout() {
               onClick={() => setCollapsed((v) => !v)}
               title={collapsed ? t("nav.expandSidebar") : t("nav.collapseSidebar")}
               aria-label={collapsed ? t("nav.expandSidebar") : t("nav.collapseSidebar")}
-              className="rounded p-1.5 text-app-muted hover:bg-app-hover hover:text-app-fg"
+              className="inline-flex h-7 w-7 items-center justify-center rounded text-app-muted hover:bg-app-hover hover:text-app-fg"
             >
               <Icon name={collapsed ? "show" : "hide"} size={16} />
             </button>
             <ThemeToggle />
           </div>
         </div>
-        <div className={`pb-2 ${collapsed ? "px-2" : "px-3"}`}>
+        <div className={`pb-2 pt-2.5 ${collapsed ? "px-2" : "px-3"}`}>
           <button
             className="flex w-full items-center justify-center gap-2 rounded-lg bg-app-accent py-2 text-[15px] font-medium text-app-accent-fg shadow-sm hover:opacity-90"
             title={collapsed ? t("nav.compose") : undefined}