M4: Calendar plugin (builtin) + mail HTML/attachment fixes

Calendar plugin (webmail_plugin_calendar, non-removable core plugin):
- Local calendars/events CRUD with RLS isolation; recurrence expanded at
  query time (DST-correct), EXDATE + detached-override merge.
- Calendar app bundle: month/week/day/3-day views, mini-month, event form
  (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient
  autocomplete, Jitsi video call), event popover with RSVP badges, resizable/
  collapsible left panel + theme toggle, overlap layout.
- iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML +
  text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token)
  records accepted/declined/tentative per attendee.
- "This and following" edit + scoped delete (this / this-and-following), with
  a delete confirmation dialog for recurring events.

Core:
- Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations
  section; date order follows time format (en-GB vs en-US) across Mail.
- Plugin SDK: mail (send from a user's account), vault (envelope encrypt),
  multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed
  PluginPage.

Mail HTML rendering:
- Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like,
  strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so
  already-indexed mail re-sanitizes on view.
- Attachments: a Content-Disposition: attachment part is a real attachment
  even when it also carries a Content-ID (fixes hidden invite.ics).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/accounts/ssrf.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 import asyncio
 import ipaddress
 import socket
+from dataclasses import dataclass
 from urllib.parse import urlsplit
 
 import httpx
@@ -87,3 +88,51 @@ async def guarded_get(url: str) -> str | None:
                 raise SsrfError("response exceeds 256 KB cap")
             chunks.append(chunk)
     return b"".join(chunks).decode("utf-8", "replace")
+
+
+@dataclass(frozen=True)
+class GuardedResponse:
+    status: int
+    headers: dict[str, str]
+    text: str
+
+
+async def guarded_request(
+    method: str,
+    url: str,
+    *,
+    headers: dict[str, str] | None = None,
+    content: bytes | str | None = None,
+    auth: tuple[str, str] | None = None,
+    timeout: float = 15.0,  # noqa: ASYNC109 - passed straight to httpx's own timeout
+    max_bytes: int = 25 * 1024 * 1024,
+) -> GuardedResponse:
+    """Arbitrary-method HTTPS request under the same SSRF policy as :func:`guarded_get`.
+
+    Used by plugins that speak WebDAV/CalDAV/CardDAV (PROPFIND/REPORT/PUT/DELETE) or
+    fetch ICS feeds. HTTPS-only, public host required, no off-domain redirects, body
+    capped at ``max_bytes``. ``auth`` is an (user, password) basic-auth pair. Returns
+    status + headers + body (all statuses; the caller decides what's an error)."""
+    parts = urlsplit(url)
+    if parts.scheme != "https":
+        raise SsrfError("only https is permitted")
+    if not parts.hostname:
+        raise SsrfError("missing host")
+    await assert_host_is_public(parts.hostname)
+
+    async with (
+        httpx.AsyncClient(follow_redirects=False, timeout=timeout, auth=auth) as client,
+        client.stream(method, url, headers=headers, content=content) as resp,
+    ):
+        chunks: list[bytes] = []
+        total = 0
+        async for chunk in resp.aiter_bytes():
+            total += len(chunk)
+            if total > max_bytes:
+                raise SsrfError("response exceeds size cap")
+            chunks.append(chunk)
+        return GuardedResponse(
+            status=resp.status_code,
+            headers=dict(resp.headers),
+            text=b"".join(chunks).decode("utf-8", "replace"),
+        )