M2: Meili search + saved searches, sync windows + backfill progress, threading & image fixes

Search:
- Meilisearch backend (app/search/meili.py) + factory wiring; pinned SDK 2.7
- Search-as-you-type: debounced query + Postgres prefix matching, built from
  the DB tokenizer so full email addresses match (email stays one lexeme)
- Saved searches API + sidebar virtual mailboxes; save affordance in the box

Account sync windows (SPEC §12 M2):
- Choose at setup: All (recent 30d first, then remainder), Last 3 months, New only
- Per-account sync_window + "Sync remaining mail" from settings (idempotent re-run)
- Provider windowed backfill (SINCE/BEFORE), message_count, newest_uid
- migration 0012: accounts.sync_window + backfill_total/backfill_done

Backfill progress UX:
- Floating progress card (auto-dissolves after 10s) + spinning sidebar ring that
  fills with the account colour; driven by sync.progress over WS

Thread list pagination:
- Server-side offset + accurate grand total, with filter/order in SQL; working
  prev/next across all synced mail

Reading panel:
- "Load images" one-off now actually renders images (?images=1) without trusting
  the sender; envelope carries images_allowed so a trusted sender shows no prompt

Threading:
- Subject fallback no longer merges messages that declare an explicit (different)
  parent; true siblings still group via a shared-parent reference match. Fixes
  unrelated auto-replies with the same subject landing in one thread

Backend 257 tests green, ruff + mypy --strict clean; frontend tsc/eslint/vitest clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/tests/api/test_saved_searches.py

@@ -0,0 +1,141 @@
+"""Saved searches CRUD — stored queries shown as virtual mailboxes (SPEC §12 M2)."""
+
+from __future__ import annotations
+
+import uuid
+from collections.abc import AsyncIterator
+from dataclasses import dataclass
+
+import httpx
+import pytest_asyncio
+from httpx import ASGITransport
+from sqlalchemy import delete
+from sqlalchemy.ext.asyncio import async_sessionmaker, create_async_engine
+from sqlalchemy.pool import NullPool
+
+from app.config import get_settings
+from app.identity.passwords import hash_password
+from app.identity.sessions import create_session
+from app.main import create_app
+from app.models import User
+
+CSRF = "csrf"
+
+
+@dataclass
+class Ctx:
+    client: httpx.AsyncClient
+    user_id: uuid.UUID
+
+
+def _hdr() -> dict[str, str]:
+    return {"X-CSRF": CSRF}
+
+
+@pytest_asyncio.fixture
+async def ctx() -> AsyncIterator[Ctx]:
+    engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
+    sm = async_sessionmaker(engine, expire_on_commit=False)
+    session = sm()
+    user = User(handle=f"ss{uuid.uuid4().hex[:8]}@test.local", password_hash=hash_password("pw"))
+    session.add(user)
+    await session.commit()
+    token = await create_session(user.id, "pytest")
+    client = httpx.AsyncClient(
+        transport=ASGITransport(app=create_app()),
+        base_url="http://testserver",
+        cookies={"session": token, "csrf": CSRF},
+    )
+    try:
+        yield Ctx(client=client, user_id=user.id)
+    finally:
+        await client.aclose()
+        await session.execute(delete(User).where(User.id == user.id))
+        await session.commit()
+        await session.close()
+        await engine.dispose()
+
+
+async def test_saved_search_crud_and_upsert(ctx: Ctx) -> None:
+    # Empty to start.
+    resp = await ctx.client.get("/api/saved-searches")
+    assert resp.status_code == 200
+    assert resp.json() == []
+
+    # Create.
+    resp = await ctx.client.post(
+        "/api/saved-searches",
+        json={"name": "Unread from boss", "query": "is:unread from:boss"},
+        headers=_hdr(),
+    )
+    assert resp.status_code == 200
+    created = resp.json()
+    assert created["name"] == "Unread from boss"
+    assert created["query"] == "is:unread from:boss"
+    assert created["pinned"] is True
+    sid = created["id"]
+
+    # It lists back.
+    resp = await ctx.client.get("/api/saved-searches")
+    assert [s["name"] for s in resp.json()] == ["Unread from boss"]
+
+    # Re-saving under the same name upserts (updates query, keeps a single row).
+    resp = await ctx.client.post(
+        "/api/saved-searches",
+        json={"name": "Unread from boss", "query": "is:unread from:ceo"},
+        headers=_hdr(),
+    )
+    assert resp.status_code == 200
+    assert resp.json()["id"] == sid  # same row
+    assert resp.json()["query"] == "is:unread from:ceo"
+
+    rows = (await ctx.client.get("/api/saved-searches")).json()
+    assert len(rows) == 1 and rows[0]["query"] == "is:unread from:ceo"
+
+    # Delete.
+    resp = await ctx.client.delete(f"/api/saved-searches/{sid}", headers=_hdr())
+    assert resp.status_code == 200
+    assert (await ctx.client.get("/api/saved-searches")).json() == []
+
+    # Deleting a missing row 404s.
+    resp = await ctx.client.delete(f"/api/saved-searches/{uuid.uuid4()}", headers=_hdr())
+    assert resp.status_code == 404
+
+
+async def test_saved_search_requires_csrf(ctx: Ctx) -> None:
+    # No CSRF header -> rejected (state-changing route).
+    resp = await ctx.client.post(
+        "/api/saved-searches", json={"name": "x", "query": "y"}
+    )
+    assert resp.status_code == 403
+
+
+async def test_saved_search_is_per_user(ctx: Ctx) -> None:
+    await ctx.client.post(
+        "/api/saved-searches",
+        json={"name": "Mine", "query": "in:inbox"},
+        headers=_hdr(),
+    )
+    # A different user's client sees none of the above.
+    other = User(handle=f"ss{uuid.uuid4().hex[:8]}@test.local", password_hash=hash_password("pw"))
+    engine = create_async_engine(get_settings().database_url, poolclass=NullPool)
+    sm = async_sessionmaker(engine, expire_on_commit=False)
+    session = sm()
+    session.add(other)
+    await session.commit()
+    token = await create_session(other.id, "pytest")
+    try:
+        client = httpx.AsyncClient(
+            transport=ASGITransport(app=create_app()),
+            base_url="http://testserver",
+            cookies={"session": token, "csrf": CSRF},
+        )
+        try:
+            assert (await client.get("/api/saved-searches")).json() == []
+        finally:
+            await client.aclose()
+    finally:
+        await session.execute(delete(User).where(User.id == other.id))
+        await session.commit()
+        await session.close()
+        await engine.dispose()