M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/app/sync/actions.py

@@ -77,7 +77,7 @@ async def apply_flags_to_messages(
         if message.thread_id is not None:
             thread_ids.add(message.thread_id)
     await session.flush()
-    for tid in thread_ids:
+    for tid in sorted(thread_ids):  # one lock order across transactions
         await denormalize_thread(session, tid)
     return thread_ids
 
@@ -504,7 +504,7 @@ async def empty_folder_job(ctx: dict[str, Any], user_id: str, special_use: str)
         await session.flush()
         # Threads with no messages left get dropped (drafts un-linked first); the
         # rest are re-denormalized so their counts/snippet reflect the removal.
-        for tid in thread_ids:
+        for tid in sorted(thread_ids):
             remaining = await session.scalar(
                 select(func.count()).select_from(Message).where(Message.thread_id == tid)
             )
@@ -584,7 +584,7 @@ async def autopurge_trash_spam(ctx: dict[str, Any]) -> None:
         )
         await session.execute(delete(Message).where(Message.id.in_(msg_ids)))
         await session.flush()
-        for tid in thread_ids:
+        for tid in sorted(thread_ids):
             remaining = await session.scalar(
                 select(func.count()).select_from(Message).where(Message.thread_id == tid)
             )

backend/app/sync/engine.py

@@ -354,7 +354,18 @@ async def apply_delta(
     if delta.new_uidvalidity is not None:
         # UIDVALIDITY changed: wipe this mailbox's rows and re-backfill (SPEC §6.3).
         async with session_scope() as session:
+            # Their threads are recounted: a message not brought back by the
+            # re-import (gone meanwhile) must not stay counted.
+            wiped_threads: set[uuid.UUID] = {
+                tid
+                for tid in await session.scalars(
+                    select(Message.thread_id).where(Message.mailbox_id == mailbox.id)
+                )
+                if tid is not None
+            }
             await session.execute(delete(Message).where(Message.mailbox_id == mailbox.id))
+            for tid in sorted(wiped_threads):
+                await denormalize_thread(session, tid)
             await session.execute(
                 update(Mailbox)
                 .where(Mailbox.id == mailbox.id)
@@ -428,7 +439,7 @@ async def apply_delta(
             )
         # After the deletes, so a thread left with no messages is removed rather
         # than recounted (denormalize_thread handles that case).
-        for tid in touched_threads:
+        for tid in sorted(touched_threads):  # one lock order (denormalize_thread)
             await denormalize_thread(session, tid)
 
         updates = {"last_seen_uid": max_uid}

backend/app/sync/provider_factory.py

@@ -3,6 +3,9 @@
 This module runs only inside the worker/sync context; ``decrypt_secret`` (the
 credential vault) is invoked here to obtain the plaintext mailbox password. It
 must never be imported by API request code.
+
+A native account (the user's hosted mailbox, App. D §D.4) has no stored
+password: the worker signs in as itself, acting for the user.
 """
 
 from __future__ import annotations
@@ -14,6 +17,10 @@ from app.security.crypto import decrypt_secret
 
 def build_provider(account: Account) -> ImapSmtpProvider:
     """Construct an :class:`ImapSmtpProvider` for ``account`` (password auth, M0)."""
+    if account.kind == "native":
+        from app.hosted.native import native_provider_config
+
+        return ImapSmtpProvider(native_provider_config(account.email))
     imap = account.imap_config
     smtp = account.smtp_config
     password = decrypt_secret(account.secret_ct).decode("utf-8")