Two-way draft sync, signatures, sent/bcc fixes, and mail-list UI

Backend
- Sent copies: persist locally on send + periodic multi-folder CONDSTORE poll
  (Sent/Archive/Trash/Junk) so they thread and show without an IDLE-only INBOX.
- Bcc: transmitted copy omits Bcc, Sent copy keeps it; store/display bcc_addr.
- Drafts: mirror local drafts to the IMAP Drafts folder (append/replace/expunge);
  inbound sync of foreign drafts (un-threaded) with adopt-to-edit + dedup by UID.
- Per-user storage quota (5 GiB default) and manual "sync all folders" action.
- Account editing (display/color/server/password) and per-account HTML signature.
- Account view scoped to that account's inbox; new migrations 0006–0009.

Frontend
- Mail-list pagination, folder filters (All/Unread/Pinned), sort toggle, refresh.
- Aligned + widened mail-list margins; reading-pane bars fixed height.
- Rich-text composer: color palette, highlight, image; attachments; expand/pop-out.
- Signatures: auto-insert for new mail, replace on From change, reply insert.
- Restore/Delete actions per folder; drafts view merges local + remote, date-sorted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/api/accounts.py

@@ -32,6 +32,7 @@ from app.identity.deps import CurrentUser, require_csrf
 from app.models import Account
 from app.queue import get_arq_pool
 from app.redis_client import get_redis
+from app.security.crypto import encrypt_secret
 
 router = APIRouter(prefix="/accounts", tags=["accounts"])
 
@@ -75,12 +76,27 @@ async def list_accounts(user: CurrentUser, db: DbSession) -> list[AccountOut]:
     )
     return [
         AccountOut(
-            id=a.id, email=a.email, display_name=a.display_name, color=a.color, state=a.state
+            id=a.id,
+            email=a.email,
+            display_name=a.display_name,
+            color=a.color,
+            state=a.state,
+            signature=a.signature,
         )
         for a in accounts
     ]
 
 
+@router.post("/sync", dependencies=[Depends(require_csrf)])
+async def sync_all_accounts(user: CurrentUser, db: DbSession) -> dict[str, str]:
+    """Poll every folder of each of the user's accounts (manual Refresh)."""
+    account_ids = list(await db.scalars(select(Account.id).where(Account.user_id == user.id)))
+    pool = await get_arq_pool()
+    for account_id in account_ids:
+        await pool.enqueue_job("refresh_account_job", str(account_id))
+    return {"status": "queued"}
+
+
 @router.post("/discover", response_model=DiscoverResponse, dependencies=[Depends(require_csrf)])
 async def discover_account(body: DiscoverRequest, user: CurrentUser) -> DiscoverResponse:
     await _rate_limit_discover(user.id)
@@ -135,6 +151,25 @@ async def create_new_account(
     return _detail(account)
 
 
+@router.get("/{account_id}", response_model=AccountDetailOut)
+async def get_account(account_id: uuid.UUID, user: CurrentUser, db: DbSession) -> AccountDetailOut:
+    account = await db.scalar(
+        select(Account).where(Account.id == account_id, Account.user_id == user.id)
+    )
+    if account is None:
+        raise_api_error(404, "not_found", "account not found")
+    return _detail(account)
+
+
+def _server_from_config(cfg: dict[str, object]) -> ServerConfig:
+    return ServerConfig(
+        str(cfg["host"]),
+        int(str(cfg["port"])),
+        str(cfg.get("tls", "ssl")),
+        str(cfg.get("auth", "password")),
+    )
+
+
 @router.patch(
     "/{account_id}", response_model=AccountDetailOut, dependencies=[Depends(require_csrf)]
 )
@@ -150,7 +185,51 @@ async def update_account(
         account.display_name = body.display_name
     if body.color is not None:
         account.color = body.color
+    if body.signature is not None:
+        account.signature = body.signature
+
+    # Connection settings and/or password: re-validate against the servers, then
+    # re-encrypt the secret and re-sync. The password must be supplied (§10.2: the
+    # stored secret is only decrypted in the worker, never here).
+    conn_change = body.imap is not None or body.smtp is not None or body.password is not None
+    if conn_change:
+        if not body.password:
+            raise_api_error(
+                400,
+                "password_required",
+                "the mailbox password is required to change server settings",
+            )
+        imap = (
+            _to_server_config(body.imap) if body.imap else _server_from_config(account.imap_config)
+        )
+        smtp = (
+            _to_server_config(body.smtp) if body.smtp else _server_from_config(account.smtp_config)
+        )
+        try:
+            await test_account(imap=imap, smtp=smtp, username=account.email, password=body.password)
+        except AccountTestError as exc:
+            raise_api_error(400, exc.code, exc.detail)
+        account.imap_config = {
+            "host": imap.host,
+            "port": imap.port,
+            "tls": imap.tls,
+            "auth": imap.auth,
+        }
+        account.smtp_config = {
+            "host": smtp.host,
+            "port": smtp.port,
+            "tls": smtp.tls,
+            "auth": smtp.auth,
+        }
+        account.secret_ct = encrypt_secret(body.password.encode("utf-8"))
+        account.state = "backfilling"
+
     await db.commit()
+
+    if conn_change:
+        pool = await get_arq_pool()
+        await pool.enqueue_job("sync_bootstrap_account", str(account.id))
+
     return _detail(account)
 
 
@@ -171,6 +250,7 @@ def _detail(account: Account) -> AccountDetailOut:
         color=account.color,
         state=account.state,
         state_detail=account.state_detail,
+        signature=account.signature,
         imap_config=account.imap_config,
         smtp_config=account.smtp_config,
     )