Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/accounts/test_ssrf.py

@@ -0,0 +1,55 @@
+"""SSRF guard for autodiscovery (SPEC §10.6)."""
+
+from __future__ import annotations
+
+import pytest
+
+from app.accounts import ssrf
+from app.accounts.ssrf import SsrfError, _is_public_ip, assert_host_is_public, guarded_get
+
+
+@pytest.mark.parametrize(
+    "ip,public",
+    [
+        ("8.8.8.8", True),
+        ("1.1.1.1", True),
+        ("2606:4700:4700::1111", True),
+        ("127.0.0.1", False),
+        ("10.0.0.1", False),
+        ("192.168.1.1", False),
+        ("172.16.5.4", False),
+        ("169.254.1.1", False),  # link-local
+        ("::1", False),
+        ("fe80::1", False),  # link-local v6
+        ("0.0.0.0", False),
+    ],
+)
+def test_is_public_ip(ip: str, public: bool) -> None:
+    assert _is_public_ip(ip) is public
+
+
+async def test_assert_host_public_accepts_public(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    async def fake_resolve(_host: str) -> list[str]:
+        return ["8.8.8.8"]
+
+    monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
+    await assert_host_is_public("mail.example.com")  # no raise
+
+
+async def test_assert_host_rejects_private(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    async def fake_resolve(_host: str) -> list[str]:
+        return ["8.8.8.8", "127.0.0.1"]  # one private address is enough to reject
+
+    monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
+    with pytest.raises(SsrfError):
+        await assert_host_is_public("evil.example.com")
+
+
+async def test_guarded_get_rejects_non_https() -> None:
+    with pytest.raises(SsrfError):
+        await guarded_get("http://example.com/config.xml")
+
+
+async def test_guarded_get_rejects_missing_host() -> None:
+    with pytest.raises(SsrfError):
+        await guarded_get("https:///config.xml")