Security hardening from the assessment; testing fixes

Security (ultimo-security-report.md):
- Security headers on every response, the app shell included: they lived at
  server level and nginx dropped them in any location with its own header.
  CSP, framing, nosniff, referrer, permissions (docker/nginx-security.conf).
- Plain HTTP forwarded by the reverse proxy is redirected to HTTPS; HSTS on
  HTTPS responses. server_tokens off.
- Cross-site state-changing /api requests refused (login CSRF), WebSocket too.
- Validation errors in the usual error shape, without the request model.
- New-password policy: max 128, common/own-address/repeated refused,
  breached-password check (HIBP k-anonymity, fails open).
- Message HTML: links keep only http(s)/mailto (sanitizer v6); the HTML
  endpoint carries its own no-script CSP.
- Outbound fetches pinned to the checked IP (DNS rebinding); external
  IMAP/SMTP servers re-checked before each connection; CGNAT and mapped
  addresses counted as non-public.

Fixes from testing:
- IDLE loop catches up before idling: mail that came while the worker was
  away no longer waits up to 10 minutes.
- Restore from Spam/Trash/Archive moves only the removed messages, not your
  reply in Sent.
- Narrow desktop list stacks sender/subject/snippet (subject was squeezed
  to nothing at the default width), with hover actions.
- Phone: wide emails scale to fit the screen.
- Singular forms ("1 message"); no zip button for a single attachment;
  app passwords no longer claim "never used" for mail apps.
- ruff format across the backend.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/nginx.conf

@@ -28,6 +28,15 @@ map $http_x_forwarded_proto $fwd_proto {
     http    http;
 }
 
+# HSTS only for requests that came in over HTTPS (nginx-security.conf).
+map $fwd_proto $hsts {
+    https   "max-age=31536000";
+    default "";
+}
+
+# No nginx version in the Server header or on error pages.
+server_tokens off;
+
 # Connection header for the WebSocket upgrade dance on /api/ws.
 map $http_upgrade $connection_upgrade {
     default upgrade;
@@ -44,6 +53,13 @@ server {
     listen 80;
     server_name _;
 
+    # The reverse proxy in front (DSM) terminates TLS and says how the browser
+    # came in. Plain HTTP from the internet goes to HTTPS; a request with no
+    # such header (LAN access straight to WEB_PORT) is left alone.
+    if ($http_x_forwarded_proto = "http") {
+        return 301 https://$host$request_uri;
+    }
+
     # Regex locations beat prefix ones, so this wins over `location /api/`
     # regardless of order. `(/|$)` keeps it to /api/admin and /api/admin/...,
     # never a future /api/administrators. 404 rather than 403: a port open to
@@ -76,6 +92,7 @@ server {
 
     location = /admin.html {
         add_header Cache-Control "no-store, must-revalidate";
+        include /etc/nginx/webmail-security.conf;
     }
 
     # SPA fallback -> the admin panel. `/` on this port IS the panel; the mail