mail UX: restore-to-folder, draft/attachment fixes, printing, sidebar collapse

Backend:
- Restore returns each message to its original folder (e.g. Sent/Archive) instead
  of always the Inbox: new messages.restore_mailbox_id (migration 0010) +
  restore_thread_job.
- Drafts: expunge reconciliation for the Drafts poll (provider.list_uids /
  _reconcile_drafts) clears phantom "remote" drafts; send + discard drop the
  mirrored DB row; adopting a remote draft carries its real attachments into the
  compose flow.
- Thread detail/list are folder-aware: individually trashed/spam messages are
  hidden outside their folder, Trash/Spam show only their own messages, and the
  mail-list message count matches the view.

Frontend:
- Thread reading panel: fix newest-first card overlap/spacing (expand-all and
  single expand), hide Reply/Forward on trashed messages, close the Actions menu
  on message-body (iframe) clicks, scroll to the inline composer, and prompt
  Save draft / Discard on the X close.
- Composer: remount when switching drafts, dirty-tracking to stop duplicate IMAP
  mirrors, and close the From/More dropdowns on outside click.
- Sidebar: collapse/expand toggle (icons-only ~60px rail) and a log-out icon on
  Sign out.
- Mail-standard printing in a new window with reliable page margins (lib/print.ts).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/tests/outbox/test_outbox.py

@@ -274,6 +274,73 @@ async def test_remote_drafts_listed_and_adopted(ctx: Ctx) -> None:
     assert again.json()["id"] == draft["id"]
 
 
+async def test_adopt_remote_draft_carries_attachments(ctx: Ctx) -> None:
+    from datetime import UTC, datetime
+
+    from app.indexer import blobstore
+    from app.models import Attachment
+
+    drafts_mb = Mailbox(
+        account_id=ctx.account_id, user_id=ctx.user_id, path="DRAFTS", special_use="drafts"
+    )
+    ctx.session.add(drafts_mb)
+    await ctx.session.flush()
+    msg = Message(
+        user_id=ctx.user_id,
+        account_id=ctx.account_id,
+        mailbox_id=drafts_mb.id,
+        uid=95,
+        subject="Home draft with file",
+        to_addr=[{"name": "", "email": "bob@example.com"}],
+        cc_addr=[],
+        bcc_addr=[],
+        internal_date=datetime.now(UTC),
+        blob_sha256="y" * 64,
+        snippet="",
+        has_attachments=True,
+    )
+    ctx.session.add(msg)
+    await ctx.session.flush()
+    # A real (downloadable) attachment plus an inline cid image, which must NOT be carried.
+    sha = blobstore.store(ctx.user_id, b"file contents")
+    ctx.session.add(
+        Attachment(
+            message_id=msg.id,
+            user_id=ctx.user_id,
+            filename="report.pdf",
+            mime_type="application/pdf",
+            size_bytes=13,
+            content_id=None,
+            blob_sha256=sha,
+        )
+    )
+    ctx.session.add(
+        Attachment(
+            message_id=msg.id,
+            user_id=ctx.user_id,
+            filename="logo.png",
+            mime_type="image/png",
+            size_bytes=3,
+            content_id="logo@x",
+            blob_sha256=blobstore.store(ctx.user_id, b"img"),
+        )
+    )
+    await ctx.session.commit()
+
+    adopted = await ctx.client.post(f"/api/drafts/adopt/{msg.id}", headers=_hdr())
+    assert adopted.status_code == 200, adopted.text
+    ids = adopted.json()["payload"]["attachment_ids"]
+    assert len(ids) == 1  # only the real attachment, not the inline image
+
+    # The compose-attachment metadata resolves — this is what the editor renders and
+    # what load_attachments re-attaches on send.
+    meta = await ctx.client.get("/api/attachments", params={"ids": ",".join(ids)})
+    assert meta.status_code == 200
+    body = meta.json()
+    assert [a["filename"] for a in body] == ["report.pdf"]
+    assert body[0]["size_bytes"] == 13
+
+
 async def test_publish_draft_enqueues_imap_mirror(ctx: Ctx) -> None:
     did = (await ctx.client.post("/api/drafts", json=_draft_body(ctx), headers=_hdr())).json()["id"]
     ctx.enqueued.clear()