sync-v2 step 5: activity tiers (hot/warm/cold)

Each owned account is tiered by the coordinator; the runner shapes its work to
match — correctness identical, only latency/socket cost differ.

- hot: persistent INBOX IDLE + secondary poll every POLL_WARM.
- warm: no persistent socket; transient INBOX+special poll every POLL_WARM.
- cold: same transient poll every POLL_COLD.
- engine: poll_all_loop (transient full poll); secondary_poll_loop interval is
  now a parameter; POLL_INTERVAL removed in favor of POLL_WARM/POLL_COLD.
- coordinator: tier eval every 120s from session heat (sess:active:{user}) +
  recent mail (max internal_date within TIER_HOT_ACTIVITY_H), with the
  HOT_BUDGET_PER_WORKER guard shedding least-recently-active session-less hot
  accounts; user.active event promotes a user's accounts to hot at once (≤5s).
- API: login + WS connect/ping publish user.active and refresh sess:active
  (TTL TIER_SESSION_GRACE_MIN). New sync:tier:{id} key, default warm on claim.
- config: POLL_WARM/POLL_COLD/TIER_*/HOT_BUDGET_PER_WORKER.
- tests: 5 tier tests (session/recent-mail promotion, cold, user.active,
  budget demotion) alongside the lease/lifecycle acceptance tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/identity/routes.py

@@ -51,6 +51,8 @@ from app.identity.sessions import (
     revoke_session,
 )
 from app.models import User
+from app.redis_client import get_redis
+from app.sync import leases
 
 router = APIRouter(prefix="/auth", tags=["auth"])
 
@@ -117,7 +119,10 @@ async def login(body: LoginRequest, request: Request, response: Response, db: Db
     if user is None:
         raise_api_error(401, "invalid_credentials", "incorrect handle or password")
     await _establish_session(request, response, user)
-    # Sync v2 §3: a login marks the user active, promoting their accounts' tier.
+    # Sync v2 §3/§5: a login marks the user active (session heat) and promotes
+    # their accounts' tier to hot.
+    settings = get_settings()
+    await leases.mark_user_active(get_redis(), user.id, settings.tier_session_grace_min * 60)
     await get_event_bus().publish("user.active", {"user_id": str(user.id)})
     return _user_out(user)