M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/identity/user_admin.py

@@ -67,7 +67,16 @@ async def search_users(db: AsyncSession, q: str) -> list[tuple[User, int, list[s
 
 
 async def set_blocked(db: AsyncSession, user: User, blocked: bool) -> None:
-    """Block or unblock. Blocking also signs the user out everywhere."""
+    """Block or unblock. Blocking also signs the user out everywhere, and shuts
+    their hosted mailbox to every sign-in (mail apps included); it still
+    receives mail. The mail server goes first: if it cannot be told, nothing
+    changes."""
+    from app import hosted
+
+    if hosted.enabled():
+        from app.hosted import admin as mail_admin
+
+        await mail_admin.set_blocked(user.handle, blocked)
     if blocked and user.blocked_at is None:
         user.blocked_at = dt.datetime.now(dt.UTC)
         await db.flush()
@@ -97,8 +106,18 @@ async def _plugin_tables(db: AsyncSession) -> list[str]:
 
 
 async def delete_user(db: AsyncSession, user: User) -> None:
-    """Delete ``user`` and everything they own. Commits."""
+    """Delete ``user`` and everything they own. Commits.
+
+    Their hosted mailbox goes first, with all its mail: if the mail server
+    cannot be reached nothing is deleted — a mailbox left behind would be
+    handed, mail and all, to whoever registers the address next."""
+    from app import hosted
+
     user_id = user.id
+    if hosted.enabled():
+        from app.hosted import admin as mail_admin
+
+        await mail_admin.delete_account(user.handle)
 
     # Mail accounts first, one by one: this is what stops their sync runners and
     # tidies threads, exactly as when the user removes an account themselves.