M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/docker-compose.yml

@@ -117,6 +117,29 @@ services:
       timeout: 3s
       retries: 10
 
+  # Hosted mailboxes (SPEC Appendix D). Everything but where its database is
+  # (config.json) lives in that database and is set up by
+  # `python -m app.hosted.provision`, which also creates the database and its
+  # role — so the first start waits (restarting) until that has run once.
+  # Dev publishes the ports on loopback, off the standard numbers.
+  stalwart:
+    image: stalwartlabs/stalwart:v0.16.19
+    environment:
+      STALWART_DB_PASSWORD: ${STALWART_DB_PASSWORD:-stalwart_dev}
+      STALWART_RECOVERY_ADMIN: admin:${STALWART_ADMIN_SECRET:-stalwart_admin_dev}
+    volumes:
+      - ./stalwart/config.json:/etc/stalwart/config.json:ro
+      - stalwartdata:/var/lib/stalwart
+    ports:
+      - "127.0.0.1:8180:8080"   # management API (JMAP)
+      - "127.0.0.1:1025:25"     # SMTP — mail from "outside"
+      - "127.0.0.1:1465:465"    # submissions
+      - "127.0.0.1:1587:587"    # submission (STARTTLS)
+      - "127.0.0.1:1993:993"    # IMAPS
+    depends_on:
+      postgres: { condition: service_healthy }
+    restart: unless-stopped
+
   # Test mail servers (integration tests + manual dev against a throwaway mailbox)
   # Spelling and grammar checking for the compose window (POST /api/spellcheck
   # forwards to it; the browser never talks to it directly). No n-gram data:
@@ -152,3 +175,4 @@ volumes:
   blobs:
   rspamddata:
   rspamdredis:
+  stalwartdata: