Gmail label sync + no-dup backfill, live label/UI updates, account-delete cleanup, Sync-SPAM toggle, sidebar logo

Gmail sync (SPEC: Gmail sync):
- Provider fetches X-GM-LABELS when X-GM-EXT-1 is advertised; parses custom labels
  (system labels dropped, mUTF-7 decoded) onto RemoteMessage.
- Engine syncs only system folders + All Mail for Gmail, skips every label folder,
  and dedupes the All Mail pass by Message-ID — kills the INBOX/All-Mail duplication.
- Custom labels ride the message.new event; the labels plugin subscribes and maps
  them to chips as "<name> [Gmail]" (per-message + thread aggregate + known set),
  so labels fill in gradually with the sync window. Non-ASCII labels decode right.

Labels self-healing (message-driven reconcile):
- Per-message keys are the source of truth; t: aggregates and _labels are derived.
  Reconcile drops labels of deleted messages, regroups survivors by their current
  thread (fixing JWZ thread merges), rewrites changed t: keys, and rebuilds _labels
  from live messages — keeping user labels, dropping orphaned Gmail ones.
- New SDK reads: sdk.threads.existing / sdk.messages.threads_of. Sidebar refreshes
  live via a plugin.labels.changed WS event on new labels.

Account deletion: prune threads left empty after the cascade (they were user-scoped,
so only messages cascaded) + de-list the account from surviving cross-account threads.

Sync SPAM: opt-in per-account sync_spam (migration 0015, default off) — the engine
skips the Junk folder in backfill and poll unless enabled; wizard checkbox added.

Robustness / UX:
- WebSocket auto-reconnects with backoff and resyncs on (re)connect, and account
  add/delete invalidates threads/labels — no more hard refresh for live updates.
- Backfill banner + sidebar ring also require done < total, so a completed account
  can't leave a stuck "X of X".
- Scrub lone UTF-16 surrogates from parsed headers/bodies so bad messages no longer
  crash the backfill on Postgres text/JSONB.
- Ultimo signet logo in the Mail/Calendar/Contacts sidebar header (and at the top of
  the collapsed rail), via the shared plugin-ui.css + MailLayout.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

frontend/src/i18n/en.ts

@@ -239,6 +239,7 @@ export const en = {
   "wizard.creating": "Adding…",
   "wizard.created": "Account added — syncing your mail.",
   "wizard.startReading": "Start reading now",
+  "wizard.backToAccounts": "Back to accounts",
   "wizard.manualConfig": "Enter settings manually",
   "wizard.displayName": "Display name",
   "wizard.syncWindow": "How much mail to sync",
@@ -249,6 +250,8 @@ export const en = {
   "wizard.syncWindow.new": "New mail only",
   "wizard.syncWindow.new.hint":
     "Nothing from before now — download older mail anytime from account settings.",
+  "wizard.syncSpam": "Sync spam?",
+  "wizard.syncSpam.hint": "Also import the Spam/Junk folder. Off by default.",
 
   // Provider credential-helper panel (app passwords, SPEC §6.2.2).
   "wizard.appPassword.title": "Create an app password",
@@ -272,8 +275,9 @@ export const en = {
   "wizard.appPassword.oauthInstead": "Sign in with Google instead",
   // Gmail steps.
   "wizard.help.gmail.step1": "Turn on 2-Step Verification for your Google account if you haven't.",
-  "wizard.help.gmail.step2": "On the App passwords page, name the password (e.g. \"ultimo.email\") and create it.",
-  "wizard.help.gmail.step3": "Copy the 16-character password and paste it below.",
+  "wizard.help.gmail.step2": "Click the button to generate an app password.",
+  "wizard.help.gmail.step3": "On the App passwords page, name the password (e.g. \"ultimo.email\") and create it.",
+  "wizard.help.gmail.step4": "Copy the 16-character password and paste it below.",
   // Outlook / Microsoft personal steps.
   "wizard.help.outlook.step1": "Turn on two-step verification in your Microsoft account security settings.",
   "wizard.help.outlook.step2": "Under Advanced security options, create a new app password.",