Gmail label sync + no-dup backfill, live label/UI updates, account-delete cleanup, Sync-SPAM toggle, sidebar logo

Gmail sync (SPEC: Gmail sync):
- Provider fetches X-GM-LABELS when X-GM-EXT-1 is advertised; parses custom labels
  (system labels dropped, mUTF-7 decoded) onto RemoteMessage.
- Engine syncs only system folders + All Mail for Gmail, skips every label folder,
  and dedupes the All Mail pass by Message-ID — kills the INBOX/All-Mail duplication.
- Custom labels ride the message.new event; the labels plugin subscribes and maps
  them to chips as "<name> [Gmail]" (per-message + thread aggregate + known set),
  so labels fill in gradually with the sync window. Non-ASCII labels decode right.

Labels self-healing (message-driven reconcile):
- Per-message keys are the source of truth; t: aggregates and _labels are derived.
  Reconcile drops labels of deleted messages, regroups survivors by their current
  thread (fixing JWZ thread merges), rewrites changed t: keys, and rebuilds _labels
  from live messages — keeping user labels, dropping orphaned Gmail ones.
- New SDK reads: sdk.threads.existing / sdk.messages.threads_of. Sidebar refreshes
  live via a plugin.labels.changed WS event on new labels.

Account deletion: prune threads left empty after the cascade (they were user-scoped,
so only messages cascaded) + de-list the account from surviving cross-account threads.

Sync SPAM: opt-in per-account sync_spam (migration 0015, default off) — the engine
skips the Junk folder in backfill and poll unless enabled; wizard checkbox added.

Robustness / UX:
- WebSocket auto-reconnects with backoff and resyncs on (re)connect, and account
  add/delete invalidates threads/labels — no more hard refresh for live updates.
- Backfill banner + sidebar ring also require done < total, so a completed account
  can't leave a stuck "X of X".
- Scrub lone UTF-16 surrogates from parsed headers/bodies so bad messages no longer
  crash the backfill on Postgres text/JSONB.
- Ultimo signet logo in the Mail/Calendar/Contacts sidebar header (and at the top of
  the collapsed rail), via the shared plugin-ui.css + MailLayout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/app/indexer/mime.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import email
 import os
+import re
 from dataclasses import dataclass, field
 from datetime import datetime
 from email.headerregistry import AddressHeader
@@ -20,6 +21,19 @@ from app.threading_.normalize import normalize_message_id, normalize_reference_l
 
 _SNIPPET_LEN = 160
 
+# Undecodable header/body bytes come out of the stdlib parser as lone UTF-16
+# surrogates (U+D800–U+DFFF). Those are invalid UTF-8, so Postgres rejects them in
+# text/JSONB columns — scrub them to U+FFFD before anything is stored.
+_SURROGATE_RE = re.compile("[\ud800-\udfff]")
+
+
+def _scrub(value: str) -> str:
+    return _SURROGATE_RE.sub("�", value) if value else value
+
+
+def _scrub_addrs(addrs: list[dict[str, str]]) -> list[dict[str, str]]:
+    return [{k: _scrub(v) for k, v in addr.items()} for addr in addrs]
+
 
 @dataclass(frozen=True)
 class ParsedAttachment:
@@ -112,7 +126,7 @@ def _extract_attachments(msg: EmailMessage) -> list[ParsedAttachment]:
         inline = cid is not None and disposition != "attachment"
         out.append(
             ParsedAttachment(
-                filename=filename or "attachment",
+                filename=_scrub(filename or "attachment"),
                 mime_type=part.get_content_type(),
                 content_id=cid.strip("<>") if (inline and cid is not None) else None,
                 payload=payload,
@@ -166,13 +180,13 @@ def _parse_email(msg: EmailMessage) -> ParsedEmail:
         message_id=message_id,
         in_reply_to=in_reply_to,
         references=references,
-        subject=subject,
-        from_addr=_addresses(msg, "From"),
-        to_addr=_addresses(msg, "To"),
-        cc_addr=_addresses(msg, "Cc"),
-        bcc_addr=_addresses(msg, "Bcc"),
+        subject=_scrub(subject),
+        from_addr=_scrub_addrs(_addresses(msg, "From")),
+        to_addr=_scrub_addrs(_addresses(msg, "To")),
+        cc_addr=_scrub_addrs(_addresses(msg, "Cc")),
+        bcc_addr=_scrub_addrs(_addresses(msg, "Bcc")),
         date=date,
-        text_body=text_body or "",
-        html_body=html_body,
+        text_body=_scrub(text_body or ""),
+        html_body=_scrub(html_body) if html_body is not None else None,
         attachments=_extract_attachments(msg),
     )