M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/indexer/test_streaming_parse.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import uuid
 from email.message import EmailMessage
+from pathlib import Path
 
 from app.indexer import indexer
 from app.indexer.mime import parse_message, parse_message_file
@@ -50,6 +51,8 @@ async def test_parse_bounded_streams_large_messages(monkeypatch) -> None:  # typ
 
     monkeypatch.setattr(indexer, "parse_message_file", fake_file)
     monkeypatch.setattr(indexer, "parse_message", fake_bytes)
+    # The message's file, written before parsing (blob store or raw cache).
+    monkeypatch.setattr(indexer.rawstore, "locate", lambda user_id, sha: Path("/blob"))
 
     user_id = uuid.uuid4()
     small = await indexer._parse_bounded(user_id, "sha", b"x" * 16)