Initial commit: webmail client (M0/M1)

Three-pane webmail client.
- Backend: FastAPI + async SQLAlchemy + arq worker (Postgres/Redis), IMAP/SMTP
  sync, threading, search, drafts/outbox with undo, attachments, 2FA.
- Frontend: React 18 + Vite + TypeScript + TanStack Query + Tailwind; three-pane
  UI with rich-text composer, light/dark themes, resizable panels.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/threading/test_threading.py

@@ -0,0 +1,137 @@
+"""JWZ threading test vectors (SPEC §7.4). All must pass."""
+
+from __future__ import annotations
+
+from tests.threading.env import ThreadingEnv
+
+
+async def test_linear_chain(env: ThreadingEnv) -> None:
+    a = await env.add(message_id="a@x.com", subject="Hello")
+    b = await env.add(
+        message_id="b@x.com",
+        subject="Re: Hello",
+        in_reply_to="a@x.com",
+        references=["a@x.com"],
+        minutes=1,
+    )
+    c = await env.add(
+        message_id="c@x.com",
+        subject="Re: Hello",
+        in_reply_to="b@x.com",
+        references=["a@x.com", "b@x.com"],
+        minutes=2,
+    )
+    assert a.thread_id == b.thread_id == c.thread_id
+
+
+async def test_chain_out_of_order(env: ThreadingEnv) -> None:
+    # C arrives first, then A, then B — all must end in one thread.
+    c = await env.add(
+        message_id="c@x.com", subject="Re: Hi", references=["a@x.com", "b@x.com"], minutes=2
+    )
+    a = await env.add(message_id="a@x.com", subject="Hi", minutes=0)
+    b = await env.add(message_id="b@x.com", subject="Re: Hi", references=["a@x.com"], minutes=1)
+    assert a.thread_id == b.thread_id == c.thread_id
+
+
+async def test_reply_missing_in_reply_to_but_has_references(env: ThreadingEnv) -> None:
+    a = await env.add(message_id="a@x.com", subject="Topic")
+    b = await env.add(
+        message_id="b@x.com", subject="Re: Topic", references=["a@x.com"], minutes=1
+    )  # no In-Reply-To
+    assert a.thread_id == b.thread_id
+
+
+async def test_thread_merge_on_late_parent(env: ThreadingEnv) -> None:
+    # Two children of A arrive first (each referencing only A) forming separate
+    # threads; the late parent A must merge them into one.
+    b = await env.add(message_id="b@x.com", subject="Re: T", references=["a@x.com"], minutes=1)
+    c = await env.add(message_id="c@x.com", subject="Re: T", references=["a@x.com"], minutes=2)
+    # b and c both reference a but not each other -> initially could be separate threads
+    a = await env.add(message_id="a@x.com", subject="T", minutes=0)
+    await env.session.refresh(b)
+    await env.session.refresh(c)
+    assert a.thread_id == b.thread_id == c.thread_id
+
+
+async def test_broken_client_subject_only_joins(env: ThreadingEnv) -> None:
+    # A client that drops References; joins by subject + shared participant within 7 days.
+    a = await env.add(
+        message_id="a@x.com",
+        subject="Project update",
+        from_email="alice@example.com",
+        to_email="bob@example.com",
+    )
+    b = await env.add(
+        message_id="b@x.com",
+        subject="Re: Project update",
+        from_email="bob@example.com",
+        to_email="alice@example.com",
+        minutes=60,
+    )  # no references, shares participants
+    assert a.thread_id == b.thread_id
+
+
+async def test_distinct_topic_same_subject_does_not_join(env: ThreadingEnv) -> None:
+    a = await env.add(
+        message_id="a@x.com",
+        subject="hi",
+        from_email="alice@example.com",
+        to_email="bob@example.com",
+    )
+    b = await env.add(
+        message_id="b@x.com",
+        subject="hi",
+        from_email="carol@example.com",
+        to_email="dave@example.com",
+        minutes=5,
+    )
+    assert a.thread_id != b.thread_id
+
+
+async def test_cross_account_merge(env: ThreadingEnv) -> None:
+    # A message in account A references a message in account B -> one thread (I-3).
+    a = await env.add(message_id="a@x.com", subject="Shared", account="a")
+    b = await env.add(
+        message_id="b@x.com", subject="Re: Shared", references=["a@x.com"], account="b", minutes=1
+    )
+    assert a.thread_id == b.thread_id
+    assert a.account_id != b.account_id
+
+
+async def test_duplicate_message_id_same_account_merges(env: ThreadingEnv) -> None:
+    # Same message in two mailboxes of ONE account (e.g. Gmail INBOX + All Mail):
+    # the shared Message-ID is authoritative -> one thread. (Threading-level view;
+    # the indexer decides authoritative vs synthetic per SPEC §7.1 — see indexer tests.)
+    a1 = await env.add(message_id="dup@x.com", subject="Dup", account="a")
+    a2 = await env.add(message_id="dup@x.com", subject="Dup", account="a", minutes=1)
+    assert a1.thread_id == a2.thread_id
+
+
+async def test_synthetic_ids_do_not_join(env: ThreadingEnv) -> None:
+    # Two messages that were given synthetic ids (§7.1 duplicate handling) with no
+    # references must not merge, even with the same subject far apart in time.
+    a = await env.add(message_id="deadbeef@synthetic.local", subject="Welcome", minutes=0)
+    b = await env.add(
+        message_id="cafebabe@synthetic.local", subject="Welcome", account="b", minutes=60 * 24 * 30
+    )
+    assert a.thread_id != b.thread_id
+
+
+async def test_synthetic_id_isolation(env: ThreadingEnv) -> None:
+    # Two messages lacking Message-ID and References with empty subjects never join.
+    a = await env.add(message_id=None, subject="")
+    b = await env.add(message_id=None, subject="", minutes=1)
+    assert a.thread_id != b.thread_id
+
+
+async def test_denormalization_counts(env: ThreadingEnv) -> None:
+    from app.models import Thread
+
+    a = await env.add(message_id="a@x.com", subject="Count", flags=["\\Seen"])
+    await env.add(message_id="b@x.com", subject="Re: Count", references=["a@x.com"], minutes=1)
+    thread = await env.session.get(Thread, a.thread_id)
+    assert thread is not None
+    assert thread.message_count == 2
+    assert thread.unread_count == 1  # only b is unread
+    assert thread.snippet == "Re: Count"  # newest message's snippet