#21: put real mail on the webmail screens

The mail list rendered two hardcoded messages and the reader showed their
canned HTML; compose ran a countdown and then navigated away without ever
submitting anything. Both now use the API, including search, the unread
badges in the sidebar (which were the literals "3" and "1", so an empty
inbox still advertised unread mail), and marking a message read on open.

The undo window now means what it says: the message is held in the browser
and only submitted when the countdown elapses, so cancelling it means
nothing was ever queued rather than trying to recall it afterwards.

Message bodies render in an iframe with an empty sandbox - no scripts, no
same-origin - and remote references are stripped until the reader asks for
images, so a tracking pixel cannot fire on open. The previous sandbox
allowed popups.

The admin page titles and the language switcher labels now come from the
bundles. The labels live there rather than in the source because PLAN.md
R9 keeps non-ASCII out of code, and each language should be named the way
that language names it.

ADR-001 assigned the mail API to the TypeScript storage service; the
reasoning for putting it in Go instead is recorded in PLAN.md, which
.gitignore deliberately keeps out of the repository, so that revision
lives only in the working copy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/webmail/src/app/api/v1/[...path]/route.ts

@@ -11,6 +11,14 @@ import { NextRequest, NextResponse } from "next/server";
  */
 
 const AUTH_SERVICE_URL = process.env.AUTH_SERVICE_URL ?? "http://auth:3001";
+// The mail screens are served by the protocols service, which owns the folder,
+// UID, flag and blob logic. Both verify the same session token, so the browser
+// sees one origin and one cookie either way.
+const PROTOCOLS_SERVICE_URL = process.env.PROTOCOLS_SERVICE_URL ?? "http://protocols:8080";
+
+function upstreamFor(path: string[]): string {
+  return path[0] === "mail" ? PROTOCOLS_SERVICE_URL : AUTH_SERVICE_URL;
+}
 
 // Hop-by-hop headers must not be forwarded (RFC 9110 section 7.6.1), and the
 // upstream sets its own content-length.
@@ -36,7 +44,7 @@ function filterHeaders(source: Headers): Headers {
 }
 
 async function forward(req: NextRequest, path: string[]): Promise<Response> {
-  const target = `${AUTH_SERVICE_URL}/api/v1/${path.join("/")}${req.nextUrl.search}`;
+  const target = `${upstreamFor(path)}/api/v1/${path.join("/")}${req.nextUrl.search}`;
   const headers = filterHeaders(req.headers);
 
   // The client's address is what the auth service records on sessions and
@@ -60,7 +68,7 @@ async function forward(req: NextRequest, path: string[]): Promise<Response> {
     // A dead upstream is a gateway problem, not a 404 - the difference decides
     // whether an operator looks at the auth service or at this route.
     return NextResponse.json(
-      { error: "UPSTREAM_UNAVAILABLE", message: "Authentication service is unreachable" },
+      { error: "UPSTREAM_UNAVAILABLE", message: "Upstream service is unreachable" },
       { status: 502 },
     );
   }