Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/indexer/test_blobstore.py

@@ -0,0 +1,43 @@
+"""Content-addressed blob store (SPEC §4, §6.4)."""
+
+from __future__ import annotations
+
+import uuid
+
+import pytest
+
+from app.indexer import blobstore
+
+
+@pytest.fixture(autouse=True)
+def _blob_root(tmp_path, monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    from app.config import get_settings
+
+    settings = get_settings()
+    monkeypatch.setattr(settings, "blob_root", str(tmp_path))
+
+
+def test_store_and_load_roundtrip() -> None:
+    uid = uuid.uuid4()
+    data = b"hello world"
+    sha = blobstore.store(uid, data)
+    assert blobstore.load(uid, sha) == data
+    assert blobstore.exists(uid, sha)
+
+
+def test_store_is_content_addressed_and_dedupes() -> None:
+    uid = uuid.uuid4()
+    sha1 = blobstore.store(uid, b"same payload")
+    sha2 = blobstore.store(uid, b"same payload")
+    assert sha1 == sha2
+    # path layout: {user}/{sha[:2]}/{sha}
+    path = blobstore.blob_path(uid, sha1)
+    assert path.parent.name == sha1[:2]
+    assert path.parent.parent.name == str(uid)
+
+
+def test_different_users_isolated() -> None:
+    u1, u2 = uuid.uuid4(), uuid.uuid4()
+    sha = blobstore.store(u1, b"payload")
+    assert blobstore.exists(u1, sha)
+    assert not blobstore.exists(u2, sha)