M4: Calendar plugin (builtin) + mail HTML/attachment fixes

Calendar plugin (webmail_plugin_calendar, non-removable core plugin):
- Local calendars/events CRUD with RLS isolation; recurrence expanded at
  query time (DST-correct), EXDATE + detached-override merge.
- Calendar app bundle: month/week/day/3-day views, mini-month, event form
  (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient
  autocomplete, Jitsi video call), event popover with RSVP badges, resizable/
  collapsible left panel + theme toggle, overlap layout.
- iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML +
  text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token)
  records accepted/declined/tentative per attendee.
- "This and following" edit + scoped delete (this / this-and-following), with
  a delete confirmation dialog for recurring events.

Core:
- Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations
  section; date order follows time format (en-GB vs en-US) across Mail.
- Plugin SDK: mail (send from a user's account), vault (envelope encrypt),
  multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed
  PluginPage.

Mail HTML rendering:
- Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like,
  strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so
  already-indexed mail re-sanitizes on view.
- Attachments: a Content-Disposition: attachment part is a real attachment
  even when it also carries a Content-ID (fixes hidden invite.ics).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/indexer/mime.py

@@ -98,16 +98,23 @@ def _extract_attachments(msg: EmailMessage) -> list[ParsedAttachment]:
             continue
         cid = part.get("Content-ID")
         filename = part.get_filename()
-        if not (filename or cid or part.get_content_disposition() == "attachment"):
+        disposition = part.get_content_disposition()
+        if not (filename or cid or disposition == "attachment"):
             continue
         payload = part.get_payload(decode=True)
         if not isinstance(payload, bytes):
             continue
+        # A part is an INLINE resource (cid: image rendered in-body, hidden from the
+        # attachment list) only when it carries a Content-ID AND is not explicitly an
+        # attachment. A part marked `Content-Disposition: attachment` is a real
+        # attachment even when it also has a Content-ID (e.g. Fastmail's invite.ics),
+        # so we drop the cid for it and it shows as a downloadable chip.
+        inline = cid is not None and disposition != "attachment"
         out.append(
             ParsedAttachment(
                 filename=filename or "attachment",
                 mime_type=part.get_content_type(),
-                content_id=cid.strip("<>") if cid else None,
+                content_id=cid.strip("<>") if (inline and cid is not None) else None,
                 payload=payload,
             )
         )