M4: Calendar plugin (builtin) + mail HTML/attachment fixes

Calendar plugin (webmail_plugin_calendar, non-removable core plugin):
- Local calendars/events CRUD with RLS isolation; recurrence expanded at
  query time (DST-correct), EXDATE + detached-override merge.
- Calendar app bundle: month/week/day/3-day views, mini-month, event form
  (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient
  autocomplete, Jitsi video call), event popover with RSVP badges, resizable/
  collapsible left panel + theme toggle, overlap layout.
- iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML +
  text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token)
  records accepted/declined/tentative per attendee.
- "This and following" edit + scoped delete (this / this-and-following), with
  a delete confirmation dialog for recurring events.

Core:
- Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations
  section; date order follows time format (en-GB vs en-US) across Mail.
- Plugin SDK: mail (send from a user's account), vault (envelope encrypt),
  multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed
  PluginPage.

Mail HTML rendering:
- Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like,
  strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so
  already-indexed mail re-sanitizes on view.
- Attachments: a Content-Disposition: attachment part is a real attachment
  even when it also carries a Content-ID (fixes hidden invite.ics).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/app/plugins/http.py

@@ -0,0 +1,41 @@
+"""SSRF-guarded, multi-method HTTP client exposed to plugins (SPEC §10.6).
+
+``sdk.http_get`` covers simple GETs; heavy plugins that speak CalDAV/CardDAV need
+other verbs (PROPFIND/REPORT/PUT/DELETE) with request bodies and basic auth. This
+facade routes all of them through the same SSRF policy (HTTPS-only, public host,
+no off-domain redirects, size cap) and returns status + headers + body.
+"""
+
+from __future__ import annotations
+
+from app.accounts.ssrf import GuardedResponse, guarded_request
+
+
+class PluginHttp:
+    async def request(
+        self,
+        method: str,
+        url: str,
+        *,
+        headers: dict[str, str] | None = None,
+        content: bytes | str | None = None,
+        auth: tuple[str, str] | None = None,
+    ) -> GuardedResponse:
+        return await guarded_request(
+            method, url, headers=headers, content=content, auth=auth
+        )
+
+    async def get(self, url: str, **kw: object) -> GuardedResponse:
+        return await self.request("GET", url, **kw)  # type: ignore[arg-type]
+
+    async def put(self, url: str, **kw: object) -> GuardedResponse:
+        return await self.request("PUT", url, **kw)  # type: ignore[arg-type]
+
+    async def delete(self, url: str, **kw: object) -> GuardedResponse:
+        return await self.request("DELETE", url, **kw)  # type: ignore[arg-type]
+
+    async def propfind(self, url: str, **kw: object) -> GuardedResponse:
+        return await self.request("PROPFIND", url, **kw)  # type: ignore[arg-type]
+
+    async def report(self, url: str, **kw: object) -> GuardedResponse:
+        return await self.request("REPORT", url, **kw)  # type: ignore[arg-type]