M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/plugins/actions.py

@@ -23,7 +23,7 @@ from sqlalchemy import select
 
 from app.db import session_scope
 from app.events import get_event_bus
-from app.indexer import blobstore
+from app.indexer import rawstore
 from app.models import Account, Mailbox, Message, Thread, User
 
 
@@ -39,9 +39,8 @@ class PluginMessages:
             )
             if msg is None or not msg.blob_sha256:
                 return None
-            sha = msg.blob_sha256
         try:
-            raw = blobstore.load(user_id, sha)
+            raw = await rawstore.ensure_bytes(msg)
         except FileNotFoundError:
             return None
         return message_from_bytes(raw).get(name)
@@ -60,9 +59,8 @@ class PluginMessages:
             )
             if msg is None or not msg.blob_sha256:
                 return None
-            sha = msg.blob_sha256
         try:
-            return blobstore.load(user_id, sha)
+            return await rawstore.ensure_bytes(msg)
         except FileNotFoundError:
             return None