M6 hosted mailboxes (off by default); dark message mode; fixes

Hosted mailboxes (SPEC App. D), behind HOSTED_MAILBOXES (off: unchanged):
- Stalwart mail server, provisioned by `python -m app.hosted.provision`;
  directory read from a Postgres view, app passwords only for mail apps
- native account per user, the worker signs in as master for the user
- raw messages of hosted mailboxes only cached, fetched back on demand
- migrations 0025 (accounts.kind, directory view), 0026 (IMAP ids bigint)

Mail:
- dark message mode switch in the reading pane (Thunderbird's algorithm)
- moves and folder creation quote the folder name ("Deleted Items"):
  swipe-to-delete / Trash no longer bounce back
- thread unread counters: lock before recount, sorted lock order,
  UIDVALIDITY re-import recounts, nightly repair_threads
- sidebar accounts sorted alphabetically, more space above headings

Settings: Security headings renamed; antispam accounts are explicit
(none ticked = none filtered), input widths, Activity hidden.
Plugin bundles served with Cache-Control: no-cache.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugins/webmail_plugin_labels/webmail_plugin_labels/router.py

@@ -179,4 +179,8 @@ async def delete_label(name: str, user_id: CurrentUserId) -> list[str]:
 async def bundle(filename: str) -> FileResponse:
     if filename not in _BUNDLES:
         raise HTTPException(status_code=404)
-    return FileResponse(_UI / filename, media_type="text/javascript")
+    # `no-cache`: revalidated on every load (a cheap 304 via the ETag), so an
+    # updated bundle is used at once instead of a copy the browser kept.
+    return FileResponse(
+        _UI / filename, media_type="text/javascript", headers={"Cache-Control": "no-cache"}
+    )

plugins/webmail_plugin_labels/webmail_plugin_labels/ui/sidebar.js

@@ -14,7 +14,7 @@ function injectStyles() {
   s.id = "lb-styles";
   s.textContent = `
     .lb-sec{position:relative;padding:4px 0 0}
-    .lb-head{display:flex;align-items:center;gap:5px;padding:10px 8px 2px 12px}
+    .lb-head{display:flex;align-items:center;gap:5px;padding:24px 8px 2px 12px}
     .lb-headbtn{display:flex;align-items:center;gap:5px;background:none;border:0;cursor:pointer;color:rgb(var(--app-faint));font:inherit;font-size:12px;font-weight:600;text-transform:uppercase;letter-spacing:.03em}
     .lb-add{margin-left:auto;background:none;border:0;color:rgb(var(--app-muted));cursor:pointer;padding:2px 6px;border-radius:4px;font-size:15px;line-height:1}
     .lb-add:hover{background:rgb(var(--app-hover));color:rgb(var(--app-fg))}