#34: fix the mail counters, the reader pane, and the state between surfaces

The counts were computed inline in JSX where nothing could test them. The
sidebar matched a folder by a special-use role folders do not always carry, its
badges were fetched once and then froze - new mail did not raise them and
reading a message did not lower it - and the list header printed the size of
the loaded page, capped at 50, as the size of the folder. The rules now live in
mailCounts.ts behind tests, useFolders keeps them current from the server's
push and from this tab's own changes, and each filter chip carries its number.

Inline images never left the server: RenderMessage dropped every part a body
references as cid:, so mail written by any normal client rendered with broken
icons. They now come back as bounded data URIs, refusing image/svg+xml, and the
reader resolves them, sizes its frame from the message instead of a fixed
500px, and renders on the light surface mail assumes.

Reading mail no longer asks for a second factor - the mailbox is behind the
account's own password - while the console still requires one unconditionally,
now collected by a step-up that does not ask again for the password the session
in hand just proved. An admin sign-in issues the webmail session too, so
leaving the console is a link rather than another login.

Two defects found while testing the above:

  - The admin sign-in checked the password and the second factor and never the
    role, so any account that had enrolled a factor from its own settings could
    obtain an admin-audience session.
  - Session tokens carried nothing that varied below one second, so signing in
    twice within the same second minted the identical token and collided with
    the unique index on web_sessions.refresh_token_hash. A correct password
    answered 500, and a double-clicked sign-in was enough to do it. Tokens now
    carry a jti.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/webmail/src/lib/surfaceGate.ts

@@ -0,0 +1,40 @@
+/**
+ * Which session a page needs before it can usefully render.
+ *
+ * Kept out of the middleware so it can be tested: as two inline prefix checks
+ * it could not express the case that matters, that /admin/step-up is reached
+ * *with* a webmail session and *without* an admin one. Gating it on an admin
+ * session made the screen that mints admin sessions unreachable.
+ *
+ * This is not the security boundary. Every /api/v1/* call is verified by the
+ * service that owns the signing key; this only avoids serving a shell that
+ * cannot work, and sends the visitor somewhere useful instead.
+ */
+
+export type GatedSurface = "user" | "admin";
+
+/** Paths inside a surface that must stay reachable without its session. */
+const OPEN_PATHS = new Set(["/user/login", "/admin/login"]);
+
+/**
+ * Paths that live under one surface but are gated on another.
+ *
+ * The step-up trades a webmail session for an admin one, so requiring the
+ * admin session it produces would be circular.
+ */
+const CROSS_GATED: Record<string, GatedSurface> = {
+  "/admin/step-up": "user",
+};
+
+/** True when `pathname` is inside `area` as a path segment, not as a prefix. */
+function inArea(pathname: string, area: string): boolean {
+  return pathname === area || pathname.startsWith(`${area}/`);
+}
+
+export function surfaceGateFor(pathname: string): GatedSurface | null {
+  if (OPEN_PATHS.has(pathname)) return null;
+  if (CROSS_GATED[pathname]) return CROSS_GATED[pathname];
+  if (inArea(pathname, "/admin")) return "admin";
+  if (inArea(pathname, "/user")) return "user";
+  return null;
+}