Security hardening from the assessment; testing fixes

Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
  server level and nginx dropped them in any location with its own header.
  CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
  HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
  breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
  endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
  IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
  addresses counted as non-public.

Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
  away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
  reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
  to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
  app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/sync/folder_names.py

@@ -28,24 +28,52 @@ def _compact(name: str) -> str:
 # Localized folder names by special_use. Written readably; compacted at load.
 _NAMES: dict[str, list[str]] = {
     "sent": [
-        "sent", "sent items", "sent mail", "sent messages",  # English / Outlook / Gmail
-        "wysłane", "elementy wysłane", "wiadomości wysłane",  # Polish
-        "gesendet", "gesendete objekte", "gesendete elemente",  # German
-        "envoyés", "éléments envoyés", "messages envoyés", "courrier envoyé",  # French
-        "enviados", "elementos enviados", "correo enviado",  # Spanish
-        "inviata", "posta inviata", "messaggi inviati",  # Italian
-        "verzonden", "verzonden items", "verzonden berichten",  # Dutch
-        "enviadas", "itens enviados", "mensagens enviadas",  # Portuguese
-        "отправленные", "исходящие",  # Russian
-        "skickat", "skickade", "skickade objekt",  # Swedish
-        "sendt", "sendte", "sendte elementer",  # Norwegian / Danish
+        "sent",
+        "sent items",
+        "sent mail",
+        "sent messages",  # English / Outlook / Gmail
+        "wysłane",
+        "elementy wysłane",
+        "wiadomości wysłane",  # Polish
+        "gesendet",
+        "gesendete objekte",
+        "gesendete elemente",  # German
+        "envoyés",
+        "éléments envoyés",
+        "messages envoyés",
+        "courrier envoyé",  # French
+        "enviados",
+        "elementos enviados",
+        "correo enviado",  # Spanish
+        "inviata",
+        "posta inviata",
+        "messaggi inviati",  # Italian
+        "verzonden",
+        "verzonden items",
+        "verzonden berichten",  # Dutch
+        "enviadas",
+        "itens enviados",
+        "mensagens enviadas",  # Portuguese
+        "отправленные",
+        "исходящие",  # Russian
+        "skickat",
+        "skickade",
+        "skickade objekt",  # Swedish
+        "sendt",
+        "sendte",
+        "sendte elementer",  # Norwegian / Danish
         "lähetetyt",  # Finnish
-        "odeslané", "odeslaná pošta",  # Czech
+        "odeslané",
+        "odeslaná pošta",  # Czech
     ],
     "drafts": [
-        "drafts", "draft",
-        "robocze", "kopie robocze", "wersje robocze",
-        "entwürfe", "entwurf",
+        "drafts",
+        "draft",
+        "robocze",
+        "kopie robocze",
+        "wersje robocze",
+        "entwürfe",
+        "entwurf",
         "brouillons",
         "borradores",
         "bozze",
@@ -58,44 +86,80 @@ _NAMES: dict[str, list[str]] = {
         "koncepty",  # Czech
     ],
     "trash": [
-        "trash", "deleted", "deleted items", "deleted messages", "bin", "recycle bin",
+        "trash",
+        "deleted",
+        "deleted items",
+        "deleted messages",
+        "bin",
+        "recycle bin",
         "kosz",
-        "papierkorb", "gelöschte objekte", "gelöschte elemente",
-        "corbeille", "éléments supprimés",
-        "papelera", "elementos eliminados",
-        "cestino", "posta eliminata",
-        "prullenbak", "verwijderde items",
-        "lixeira", "lixo", "itens excluídos",
-        "корзина", "удаленные",
-        "papperskorg", "borttaget",
-        "papirkurv", "slettet",
-        "roskakori", "poistetut",
+        "papierkorb",
+        "gelöschte objekte",
+        "gelöschte elemente",
+        "corbeille",
+        "éléments supprimés",
+        "papelera",
+        "elementos eliminados",
+        "cestino",
+        "posta eliminata",
+        "prullenbak",
+        "verwijderde items",
+        "lixeira",
+        "lixo",
+        "itens excluídos",
+        "корзина",
+        "удаленные",
+        "papperskorg",
+        "borttaget",
+        "papirkurv",
+        "slettet",
+        "roskakori",
+        "poistetut",
         "koš",  # Czech
     ],
     "junk": [
-        "junk", "junk email", "junk e-mail", "spam", "bulk mail", "bulk",
-        "wiadomości-śmieci", "niechciane",
-        "unerwünscht", "werbung",
-        "courrier indésirable", "indésirables", "pourriel",
-        "correo no deseado", "no deseado", "correo basura",
-        "posta indesiderata", "indesiderata",
-        "ongewenst", "ongewenste e-mail",
+        "junk",
+        "junk email",
+        "junk e-mail",
+        "spam",
+        "bulk mail",
+        "bulk",
+        "wiadomości-śmieci",
+        "niechciane",
+        "unerwünscht",
+        "werbung",
+        "courrier indésirable",
+        "indésirables",
+        "pourriel",
+        "correo no deseado",
+        "no deseado",
+        "correo basura",
+        "posta indesiderata",
+        "indesiderata",
+        "ongewenst",
+        "ongewenste e-mail",
         "lixo eletrônico",
-        "спам", "нежелательная почта",
-        "skräp", "skräppost",
+        "спам",
+        "нежелательная почта",
+        "skräp",
+        "skräppost",
         "uønsket",
         "roskaposti",
         "nevyžádaná pošta",
     ],
     "archive": [
-        "archive", "archives", "all mail",
+        "archive",
+        "archives",
+        "all mail",
         "archiwum",
         "archiv",
         "archivio",
         "archivo",
         "archief",
-        "arquivo", "arquivo morto",
-        "архив", "вся почта",
+        "arquivo",
+        "arquivo morto",
+        "архив",
+        "вся почта",
         "arkiv",
         "arkisto",
     ],