Security hardening from the assessment; testing fixes

Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
  server level and nginx dropped them in any location with its own header.
  CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
  HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
  breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
  endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
  IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
  addresses counted as non-public.

Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
  away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
  reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
  to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
  app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/sync/engine.py

@@ -172,9 +172,7 @@ class _BackfillProgress:
         self._mailboxes.add(mailbox_path)
         async with session_scope() as session:
             await session.execute(
-                update(Account)
-                .where(Account.id == self.account.id)
-                .values(backfill_done=self.done)
+                update(Account).where(Account.id == self.account.id).values(backfill_done=self.done)
             )
         await get_event_bus().publish(
             "sync.progress",
@@ -321,16 +319,28 @@ async def bootstrap_and_backfill(account_id: uuid.UUID) -> int:
             dedupe = gmail and mailbox.special_use == "archive"
             if since is not None:  # 3months: single windowed pass
                 count += await backfill_mailbox(
-                    provider, account_obj, mailbox, progress, since=since,
+                    provider,
+                    account_obj,
+                    mailbox,
+                    progress,
+                    since=since,
                     dedupe_account_scope=dedupe,
                 )
             else:  # all: recent window first (usable fast), then the remainder
                 count += await backfill_mailbox(
-                    provider, account_obj, mailbox, progress, since=recent_cutoff,
+                    provider,
+                    account_obj,
+                    mailbox,
+                    progress,
+                    since=recent_cutoff,
                     dedupe_account_scope=dedupe,
                 )
                 count += await backfill_mailbox(
-                    provider, account_obj, mailbox, progress, before=recent_cutoff,
+                    provider,
+                    account_obj,
+                    mailbox,
+                    progress,
+                    before=recent_cutoff,
                     dedupe_account_scope=dedupe,
                 )
         await _set_state(account_id, "live")
@@ -491,9 +501,7 @@ async def apply_delta(
         await _reconcile_drafts(provider, account, mailbox)
 
 
-async def _reconcile_drafts(
-    provider: ImapSmtpProvider, account: Account, mailbox: Mailbox
-) -> None:
+async def _reconcile_drafts(provider: ImapSmtpProvider, account: Account, mailbox: Mailbox) -> None:
     """Drop DB rows for drafts that no longer exist on the server (were expunged)."""
     from app.db import session_scope
 
@@ -548,13 +556,13 @@ async def live_loop(
         await provider.verify()  # signed in: the account is reachable
         if health is not None:
             await health.ok()
+        first = True
         while not stop.is_set():
-            try:
-                await provider.idle(mailbox_path)
-            except ProviderNotSupported:
-                await asyncio.sleep(idle_fallback)
-            if stop.is_set():
-                break
+            # Catch up before each IDLE, not only after it: IDLE reports what
+            # arrives from now on, so mail that came while this loop was not
+            # running (a new account's first minutes, a reconnect, a worker
+            # restart) would otherwise wait for the next new message or the
+            # IDLE timeout (10 min) to show.
             async with session_scope() as session:
                 mailbox = await session.scalar(
                     select(Mailbox).where(
@@ -562,14 +570,23 @@ async def live_loop(
                     )
                 )
                 mailbox_obj = mailbox
-            if mailbox_obj is None:
+            if mailbox_obj is not None:
+                delta = await provider.poll(
+                    mailbox_path,
+                    last_seen_uid=mailbox_obj.last_seen_uid,
+                    highestmodseq=mailbox_obj.highestmodseq,
+                )
+                await apply_delta(provider, account_obj, mailbox_obj, delta)
+            elif not first:
+                break  # the folder is gone
+            # else: the account's first sync has not recorded the folder yet.
+            first = False
+            if stop.is_set():
                 break
-            delta = await provider.poll(
-                mailbox_path,
-                last_seen_uid=mailbox_obj.last_seen_uid,
-                highestmodseq=mailbox_obj.highestmodseq,
-            )
-            await apply_delta(provider, account_obj, mailbox_obj, delta)
+            try:
+                await provider.idle(mailbox_path)
+            except ProviderNotSupported:
+                await asyncio.sleep(idle_fallback)
     finally:
         await provider.close()
 
@@ -630,9 +647,7 @@ async def poll_folders_once(
         await provider.close()
 
 
-async def _poll_secondary_once(
-    account_id: uuid.UUID, health: AccountHealth | None = None
-) -> None:
+async def _poll_secondary_once(account_id: uuid.UUID, health: AccountHealth | None = None) -> None:
     await poll_folders_once(account_id, include_inbox=False, health=health)