search: email address search + address-first ranking; inline images; folder i18n; link security

Search (PG backend):
- '@' terms match address substrings (from/to/cc), so a partial email like
  "dyrektor@wfdif" resolves and narrows predictably as you type
- index each address split into parts, so a bare domain/local word ("wfdif")
  finds the address (indexed as one lexeme otherwise); dotted terms fall back to
  an address substring
- rank sender/recipient name+address matches above body/subject-only ones
  (addr_hit tier, then recency); cursor extended to keep keyset pagination correct
- scripts/reindex_address_parts.py backfills address tokens into existing rows

Inline images:
- extract attachments via a full MIME walk instead of shallow iter_attachments(),
  which missed inline images nested in mixed>related>alternative (cid: rendered
  broken); has_attachments counts only real (non-cid) attachments
- scripts/backfill_inline_attachments.py stores previously-missed inline images

Folder-name i18n (SPEC §12 M2):
- accent/punctuation-insensitive, multi-delimiter (/ \ .) special-use inference
  across ~13 languages; curated names (no substring false positives)

Link security (reading panel):
- links never navigate the message iframe: a parent-side click interceptor opens
  http/https in a new tab (noopener) and mailto in the composer (recipient
  pre-filled); all other schemes blocked

Backend 292 tests green, ruff + mypy --strict clean; frontend tsc/eslint/vitest clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

frontend/src/components/thread/MessageBody.tsx

@@ -12,7 +12,13 @@ import { Attachments } from "./Attachments";
 // measure the content to auto-size the frame — so the message shows in full and
 // only the thread panel scrolls — and (b) send the session cookie so inline
 // (cid:) images authenticate and load.
-export function MessageBody({ message }: { message: MessageEnvelope }) {
+export function MessageBody({
+  message,
+  onMailto,
+}: {
+  message: MessageEnvelope;
+  onMailto?: (email: string) => void;
+}) {
   const t = useT();
   const queryClient = useQueryClient();
   // Seed from the server's trusted-sender flag so an already-approved sender
@@ -20,6 +26,8 @@ export function MessageBody({ message }: { message: MessageEnvelope }) {
   const [allowed, setAllowed] = useState(message.images_allowed);
   const frameRef = useRef<HTMLIFrameElement>(null);
   const observerRef = useRef<ResizeObserver | null>(null);
+  const onMailtoRef = useRef(onMailto);
+  onMailtoRef.current = onMailto;
   const [height, setHeight] = useState(80);
 
   const { data, isLoading, isError } = useQuery({
@@ -73,11 +81,31 @@ export function MessageBody({ message }: { message: MessageEnvelope }) {
     [resize],
   );
 
+  // Links must NEVER navigate the message iframe (security: a click would replace
+  // the message body, and could be used for clickjacking/phishing). The frame is
+  // same-origin, so the parent intercepts clicks here: http/https open in a new
+  // tab (noopener), mailto opens the composer, and every other scheme is blocked.
+  const handleFrameClick = useCallback((e: Event) => {
+    const el = e.target as Element | null;
+    const anchor = el?.closest?.("a[href]") as HTMLAnchorElement | null;
+    if (!anchor) return;
+    const raw = (anchor.getAttribute("href") || "").trim();
+    e.preventDefault();
+    if (/^mailto:/i.test(raw)) {
+      const email = decodeURIComponent(raw.replace(/^mailto:/i, "").split("?")[0]).trim();
+      if (email) onMailtoRef.current?.(email);
+    } else if (/^https?:\/\//i.test(raw)) {
+      window.open(anchor.href, "_blank", "noopener,noreferrer");
+    }
+    // else: relative / cid: / javascript: / data: / tel: — blocked, no navigation.
+  }, []);
+
   const onLoad = () => {
     const doc = frameRef.current?.contentDocument;
     if (!doc) return;
     injectQuoteToggle(doc);
     resize();
+    doc.addEventListener("click", handleFrameClick);
     // Re-measure as images finish loading (they change the content height).
     doc.querySelectorAll("img").forEach((img) => {
       if (!img.complete) img.addEventListener("load", resize, { once: true });