M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/outbox/inline_images.py

@@ -22,6 +22,7 @@ from sqlalchemy import select
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.indexer import attachments as att_store
+from app.indexer import rawstore
 from app.indexer.sanitize import INTERNAL_CID
 from app.models import Attachment, Message
 
@@ -64,7 +65,7 @@ async def embed(
         message_id, content_id = target
         found = (
             await session.execute(
-                select(Attachment, Message.blob_sha256)
+                select(Attachment, Message)
                 .join(Message, Message.id == Attachment.message_id)
                 .where(
                     Attachment.message_id == message_id,
@@ -76,10 +77,11 @@ async def embed(
         ).first()
         part: InlinePart | None = None
         if found is not None:
-            att, message_sha = found
+            att, message = found
             try:
+                await rawstore.ensure(message)  # a hosted mailbox's: fetched if need be
                 data = await asyncio.to_thread(
-                    att_store.load, user_id, message_sha, att.blob_sha256, att.part_index
+                    att_store.load, user_id, message.blob_sha256, att.blob_sha256, att.part_index
                 )
                 cid = make_msgid(domain=domain)[1:-1]
                 part = InlinePart(cid, att.mime_type, att.filename, data)