M4: Calendar plugin (builtin) + mail HTML/attachment fixes

Calendar plugin (webmail_plugin_calendar, non-removable core plugin):
- Local calendars/events CRUD with RLS isolation; recurrence expanded at
  query time (DST-correct), EXDATE + detached-override merge.
- Calendar app bundle: month/week/day/3-day views, mini-month, event form
  (color, show-as, timezone combobox, repeat, reminders, guests w/ recipient
  autocomplete, Jitsi video call), event popover with RSVP badges, resizable/
  collapsible left panel + theme toggle, overlap layout.
- iMIP invites: sdk.mail sends REQUEST from the organizer's mailbox (HTML +
  text/calendar + invite.ics); public /rsvp endpoint (vault-sealed token)
  records accepted/declined/tentative per attendee.
- "This and following" edit + scoped delete (this / this-and-following), with
  a delete confirmation dialog for recurring events.

Core:
- Settings: time_format (12/24h, default 24h) + jitsi_server; new Integrations
  section; date order follows time format (en-GB vs en-US) across Mail.
- Plugin SDK: mail (send from a user's account), vault (envelope encrypt),
  multi-method SSRF-guarded http; AppSwitcher product switcher; full-bleed
  PluginPage.

Mail HTML rendering:
- Sanitizer allows <style> blocks + class (CSS sanitized: drop script-like,
  strip @import/url() when remote images blocked); SANITIZER_VERSION 3 so
  already-indexed mail re-sanitizes on view.
- Attachments: a Content-Disposition: attachment part is a real attachment
  even when it also carries a Content-ID (fixes hidden invite.ics).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/plugins/PluginPage.tsx

@@ -5,7 +5,7 @@
 // header keeps a way back to Mail. (Sidebar persistence is a later refinement.)
 
 import { useEffect, useMemo, useRef } from "react";
-import { Link, Navigate, useLocation } from "react-router-dom";
+import { Navigate, useLocation } from "react-router-dom";
 
 import { useT } from "../i18n";
 import { loadBundle } from "./bundleLoader";
@@ -40,7 +40,7 @@ function PageMount({
     };
   }, [bundle, ctx, props, pluginName]);
 
-  return <div ref={ref} data-plugin-page={pluginName} className="min-h-0 flex-1 overflow-auto" />;
+  return <div ref={ref} data-plugin-page={pluginName} className="h-full overflow-auto" />;
 }
 
 export function PluginPage() {
@@ -58,17 +58,10 @@ export function PluginPage() {
   }
   if (!match) return <Navigate to="/mail" replace />;
 
+  // Full-bleed: app pages (like Calendar) own their entire chrome, including the
+  // product switcher for navigating back to Mail.
   return (
-    <div className="flex h-screen flex-col bg-app-bg">
-      <header className="flex items-center gap-3 border-b border-app-border px-4 py-2">
-        <Link
-          to="/mail"
-          className="rounded px-2 py-1 text-sm text-app-muted hover:bg-app-hover hover:text-app-fg"
-        >
-          ← {t("nav.mail")}
-        </Link>
-        <span className="text-sm font-semibold text-app-fg">{match.nav.label}</span>
-      </header>
+    <div className="h-screen bg-app-bg">
       <PageMount pluginName={match.plugin} bundle={match.bundle} subpath={subpath} />
     </div>
   );

frontend/src/plugins/context.ts

@@ -1,6 +1,7 @@
 // Builds the PluginContext handed to plugin bundles at mount (SPEC §11.3).
 
 import { useMemo } from "react";
+import { useNavigate } from "react-router-dom";
 
 import type { MessageKey } from "../i18n/en";
 import { useT } from "../i18n";
@@ -11,6 +12,7 @@ import type { PluginContext } from "./types";
 /** A memoised context bound to one plugin, usable from slots and pages. */
 export function usePluginContext(pluginName: string): PluginContext {
   const t = useT();
+  const navigate = useNavigate();
   return useMemo<PluginContext>(
     () => ({
       pluginName,
@@ -27,7 +29,8 @@ export function usePluginContext(pluginName: string): PluginContext {
       // Plugins mostly ship their own strings; app keys resolve, unknown keys
       // fall through as-is (the app translator returns the key when missing).
       t: (key, vars) => t(key as MessageKey, vars),
+      navigate: (path) => navigate(path),
     }),
-    [pluginName, t],
+    [pluginName, t, navigate],
   );
 }

frontend/src/plugins/types.ts

@@ -54,6 +54,8 @@ export interface PluginContext {
   api: PluginApi;
   events: PluginEvents;
   t: (key: string, vars?: Record<string, string | number>) => string;
+  /** Navigate the app's SPA router (e.g. back to "/mail" from a page bundle). */
+  navigate: (path: string) => void;
 }
 
 export type PluginUnmount = () => void;