#35: replace both web surfaces with the Nocturne redesign

The webmail was indigo over glass and the console was green over glass, so the
two halves of one product did not look related, and neither followed a system
anything could be checked against. This replaces the interface with the
Nocturne design system from Claude Design: a near-neutral blue-grey ground,
Inter at weight 500, solid surfaces with a 1px inset edge instead of blur, and
a single blurple accent used as a line, a mark and a glow rather than a flood.

The palette is remapped at the source rather than renamed at every call site.
tailwind.config.js points slate, indigo, emerald, teal and the rest at the
Nocturne ramps, and globals.css carries the same values as variables, so a
utility class and a token cannot drift apart and no colour can enter the
interface from outside the system. The console's green is gone because it
resolves to the one accent; that was the point.

Structurally, both surfaces now share one rail - the same brand mark, the same
3px accent mark on the active item, the same account tile - with a segmented
control for crossing between them. Crossing into the console still goes to the
step-up rather than the admin sign-in, and leaving it is still a plain link.
Settings moves from eight stacked panels to a tab strip, so enabling a second
factor and writing a filter are no longer separated by everything else.

Nothing is sized by the length of its text any more. Labels wrap, tab strips
wrap instead of scrolling, subjects and queue diagnostics wrap instead of
truncating, and the message list's snippet is clamped to two lines rather than
one. That is what broke when the interface was read in Portuguese or Spanish.

Defects found while doing it:

  - The queue and DMARC screens styled their status pills with "badge-danger",
    "badge-warning" and "badge-verified" - three class names no stylesheet in
    this project defines - so every verdict rendered as identical unstyled
    text. They are Badge variants now, which exist.
  - The DMARC screen printed the literal string "quarantine" as the
    enforcement level whatever the domains publish. The report endpoint returns
    no policy at all, so it was asserting a configuration nobody had made. It
    shows the DMARC pass ratio it genuinely has.
  - Half the mailboxes screen and two lines of the audit trace were hardcoded
    strings, some Portuguese and some English, so they stayed in one language
    whatever the interface was set to. They come from the bundle now, with the
    new keys added to all three locales.
  - Avatars printed email[0], so every account at one domain collapsed onto the
    same letter. initialsFor takes two letters from the local part's own word
    boundaries, behind tests.

Trivy reported one HIGH: nanoid 3.3.16, pulled in transitively by postcss,
vulnerable to a denial of service via an infinite loop in ID generation
(CVE-2026-67213). Pinned to ^3.3.18 through the overrides block the package
already uses for sharp and postcss.

Verified: 98 webmail tests green, tsc clean, production build clean, and the
compiled stylesheet serves the Nocturne values with no stock Tailwind indigo,
emerald or slate hex left in it. Trivy fs with the CI scanners, severities and
skip-dirs exits 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/webmail/messages/en.json

@@ -1,6 +1,7 @@
 {
   "admin": {
     "addAlias": "Add alias",
+    "aliasTarget": "Destination address",
     "aliasesTitle": "Aliases",
     "auditLog": "Audit log",
     "backToWebmail": "Back to webmail",
@@ -9,7 +10,12 @@
     "checksPassed": "{passed} of {total} passed",
     "createAccount": "Create account",
     "createAlias": "Create a routing alias",
+    "csvImportFailed": "The CSV import failed",
+    "csvImported": "Imported {count} mailboxes.",
+    "csvIntro": "Paste CSV to provision several accounts with their RFC 6154 folders. Columns: email, role, quota_mb.",
     "csvPreview": "Preview",
+    "csvRun": "Run import",
+    "csvTitle": "Bulk mailbox import (CSV)",
     "dashboardSubtitle": "Live figures read from the database.",
     "dashboardTitle": "Overview",
     "dkimAlgorithm": "Key type",
@@ -34,6 +40,7 @@
     "jobRetried": "Job {id} was queued for another attempt.",
     "lastChecked": "Last checked: {when}",
     "lastReload": "Last reload",
+    "lockAccount": "Lock",
     "mailHost": "Mail host",
     "mailboxCount": "{count} mailboxes",
     "mailboxesSubtitle": "Accounts, aliases, CSV import and the second-factor policy.",
@@ -55,6 +62,7 @@
     "queueEmpty": "The outbound queue is empty.",
     "queueSubtitle": "Inspect the outbound queue, retry a job, or cancel one.",
     "queueTitle": "Outbound queue",
+    "quotaMb": "Quota (MB)",
     "readinessIntro": "Checks the server reports about itself before it carries production mail.",
     "reconcileDns": "Reconcile DNS",
     "reconcileNotImplemented": "Per-record DNS verification is not implemented yet: this records the request and re-reads the stored status, it does not query a resolver.",
@@ -65,7 +73,10 @@
     "saveThresholds": "Save thresholds",
     "securitySubtitle": "Readiness checks, TLS state, spam thresholds and the audit trail.",
     "securityTitle": "Security",
+    "tabAccounts": "Accounts",
+    "tabAliases": "Aliases",
     "tabAudit": "Audit trail",
+    "tabCsv": "Bulk import",
     "tabReadiness": "Readiness",
     "tabRspamd": "Spam thresholds",
     "tabTls": "TLS",
@@ -73,8 +84,11 @@
     "tlsTitle": "Certificate and transport",
     "traceNoResults": "No trace found for that queue ID.",
     "tracePlaceholder": "Queue ID",
+    "traceResultFor": "Trace for {id}",
+    "traceStep": "Step {n}",
     "traceTitle": "Trace a message",
     "unknownSni": "Unknown SNI requests",
+    "unlockAccount": "Unlock",
     "verifyIntro": "Resolves every expected record against public resolvers and reports each one.",
     "watcherHealthy": "Certificate watcher"
   },
@@ -236,6 +250,7 @@
     "valuePlaceholder": "Value to match..."
   },
   "ui": {
+    "accountLocked": "Locked",
     "accountStatus": "Account status",
     "actions": "Actions",
     "active": "Active",
@@ -275,6 +290,8 @@
     "mailboxesActive": "Active mailboxes",
     "messageBody": "Message",
     "messageVolume": "Messages",
+    "mfaActive": "TOTP active",
+    "mfaNone": "No second factor",
     "newPassword": "New password",
     "noAppPasswords": "No app passwords yet.",
     "noData": "No data yet",
@@ -288,6 +305,7 @@
     "recipient": "Recipient",
     "recordName": "Record",
     "reportingOrg": "Reporting organisation",
+    "role": "Role",
     "scanners": "Spam and virus scanning",
     "sender": "Sender",
     "signOutOthers": "Sign out other devices",

services/webmail/messages/es.json

@@ -1,6 +1,7 @@
 {
   "admin": {
     "addAlias": "Añadir apelido",
+    "aliasTarget": "Dirección de destino",
     "aliasesTitle": "Alias",
     "auditLog": "Registro de auditoría",
     "backToWebmail": "Volver al webmail",
@@ -9,7 +10,12 @@
     "checksPassed": "{passed} de {total} aprobadas",
     "createAccount": "Crear cuenta",
     "createAlias": "Crear un alias de enrutamiento",
+    "csvImportFailed": "La importación del CSV falló",
+    "csvImported": "{count} buzones importados.",
+    "csvIntro": "Pega el CSV para crear varias cuentas con sus carpetas de la RFC 6154. Columnas: email, rol, cuota_mb.",
     "csvPreview": "Vista previa",
+    "csvRun": "Ejecutar la importación",
+    "csvTitle": "Importar buzones en masa (CSV)",
     "dashboardSubtitle": "Cifras en vivo leídas de la base de datos.",
     "dashboardTitle": "Resumen",
     "dkimAlgorithm": "Tipo de clave",
@@ -34,6 +40,7 @@
     "jobRetried": "El trabajo {id} se volvió a poner en cola para otro intento.",
     "lastChecked": "Última comprobación: {when}",
     "lastReload": "Última recarga",
+    "lockAccount": "Bloquear",
     "mailHost": "Host de correo",
     "mailboxCount": "{count} buzones",
     "mailboxesSubtitle": "Cuentas, alias, importación CSV y la política de segundo factor.",
@@ -55,6 +62,7 @@
     "queueEmpty": "La cola de salida está vacía.",
     "queueSubtitle": "Inspeccione la cola de salida, reintente un trabajo o cancele uno.",
     "queueTitle": "Cola de salida",
+    "quotaMb": "Cuota (MB)",
     "readinessIntro": "Verificaciones que el servidor informa sobre sí mismo antes de transportar correo en producción.",
     "reconcileDns": "Reconciliar DNS",
     "reconcileNotImplemented": "La verificación de registros DNS individuales aún no está implementada: esto registra la solicitud y relee el estado almacenado, no consulta un resolutor.",
@@ -65,7 +73,10 @@
     "saveThresholds": "Guardar umbrales",
     "securitySubtitle": "Verificaciones de preparación, estado TLS, umbrales de spam y el registro de auditoría.",
     "securityTitle": "Seguridad",
+    "tabAccounts": "Cuentas",
+    "tabAliases": "Alias",
     "tabAudit": "Registro de auditoría",
+    "tabCsv": "Importación masiva",
     "tabReadiness": "Preparación",
     "tabRspamd": "Umbrales de spam",
     "tabTls": "TLS",
@@ -73,8 +84,11 @@
     "tlsTitle": "Certificado y transporte",
     "traceNoResults": "No se encontró rastro para ese ID de cola.",
     "tracePlaceholder": "ID de la cola",
+    "traceResultFor": "Rastreo de {id}",
+    "traceStep": "Paso {n}",
     "traceTitle": "Rastrear un mensaje",
     "unknownSni": "Solicitudes SNI desconocidas",
+    "unlockAccount": "Desbloquear",
     "verifyIntro": "Resuelve cada registro esperado en resolutores públicos e informa uno por uno.",
     "watcherHealthy": "Monitor de certificado"
   },
@@ -236,6 +250,7 @@
     "valuePlaceholder": "Valor a coincidir..."
   },
   "ui": {
+    "accountLocked": "Bloqueada",
     "accountStatus": "Estado de la cuenta",
     "actions": "Acciones",
     "active": "Activo",
@@ -275,6 +290,8 @@
     "mailboxesActive": "Buzones activos",
     "messageBody": "Mensaje",
     "messageVolume": "Mensajes",
+    "mfaActive": "TOTP activo",
+    "mfaNone": "Sin segundo factor",
     "newPassword": "Nueva contraseña",
     "noAppPasswords": "Aún no hay contraseñas de aplicación.",
     "noData": "Aún sin datos",
@@ -288,6 +305,7 @@
     "recipient": "Destinatario",
     "recordName": "Registro",
     "reportingOrg": "Organización informante",
+    "role": "Rol",
     "scanners": "Análisis de spam y virus",
     "sender": "Remitente",
     "signOutOthers": "Cerrar sesión en otros dispositivos",

services/webmail/messages/pt-BR.json

@@ -1,6 +1,7 @@
 {
   "admin": {
     "addAlias": "Adicionar apelido",
+    "aliasTarget": "Endereço de destino",
     "aliasesTitle": "Apelidos",
     "auditLog": "Trilha de auditoria",
     "backToWebmail": "Voltar ao webmail",
@@ -9,7 +10,12 @@
     "checksPassed": "{passed} de {total} aprovadas",
     "createAccount": "Criar conta",
     "createAlias": "Criar um apelido de roteamento",
+    "csvImportFailed": "A importação do CSV falhou",
+    "csvImported": "{count} caixas importadas.",
+    "csvIntro": "Cole o CSV para criar várias contas com as pastas da RFC 6154. Colunas: email, papel, cota_mb.",
     "csvPreview": "Pré-visualizar",
+    "csvRun": "Executar importação",
+    "csvTitle": "Importar caixas em massa (CSV)",
     "dashboardSubtitle": "Números ao vivo lidos do banco de dados.",
     "dashboardTitle": "Visão geral",
     "dkimAlgorithm": "Tipo de chave",
@@ -34,6 +40,7 @@
     "jobRetried": "O trabalho {id} foi recolocado na fila para nova tentativa.",
     "lastChecked": "Última verificação: {when}",
     "lastReload": "Última recarga",
+    "lockAccount": "Bloquear",
     "mailHost": "Host de e-mail",
     "mailboxCount": "{count} caixas de e-mail",
     "mailboxesSubtitle": "Contas, apelidos, importação CSV e a política de segundo fator.",
@@ -55,6 +62,7 @@
     "queueEmpty": "A fila de saída está vazia.",
     "queueSubtitle": "Inspecione a fila de saída, tente reenviar um trabalho ou cancele um.",
     "queueTitle": "Fila de saída",
+    "quotaMb": "Cota (MB)",
     "readinessIntro": "Verificações que o servidor relata sobre si mesmo antes de transportar mensagens em produção.",
     "reconcileDns": "Reconciliar DNS",
     "reconcileNotImplemented": "A verificação de registros DNS individuais ainda não foi implementada: isto registra a solicitação e relê o status armazenado, não consulta um resolvedor.",
@@ -65,7 +73,10 @@
     "saveThresholds": "Salvar limites",
     "securitySubtitle": "Verificações de prontidão, estado do TLS, limites de spam e a trilha de auditoria.",
     "securityTitle": "Segurança",
+    "tabAccounts": "Contas",
+    "tabAliases": "Apelidos",
     "tabAudit": "Trilha de auditoria",
+    "tabCsv": "Importação em massa",
     "tabReadiness": "Prontidão",
     "tabRspamd": "Limites de spam",
     "tabTls": "TLS",
@@ -73,8 +84,11 @@
     "tlsTitle": "Certificado e transporte",
     "traceNoResults": "Nenhum rastro encontrado para esse ID de fila.",
     "tracePlaceholder": "ID da fila",
+    "traceResultFor": "Rastreamento de {id}",
+    "traceStep": "Etapa {n}",
     "traceTitle": "Rastrear uma mensagem",
     "unknownSni": "Requisições SNI desconhecidas",
+    "unlockAccount": "Desbloquear",
     "verifyIntro": "Resolve cada registro esperado em servidores DNS públicos e relata um a um.",
     "watcherHealthy": "Monitor de certificado"
   },
@@ -236,6 +250,7 @@
     "valuePlaceholder": "Valor a corresponder..."
   },
   "ui": {
+    "accountLocked": "Bloqueada",
     "accountStatus": "Status da conta",
     "actions": "Ações",
     "active": "Ativo",
@@ -275,6 +290,8 @@
     "mailboxesActive": "Caixas ativas",
     "messageBody": "Mensagem",
     "messageVolume": "Mensagens",
+    "mfaActive": "TOTP ativo",
+    "mfaNone": "Sem segundo fator",
     "newPassword": "Nova senha",
     "noAppPasswords": "Nenhuma senha de aplicativo ainda.",
     "noData": "Ainda sem dados",
@@ -288,6 +305,7 @@
     "recipient": "Destinatário",
     "recordName": "Registro",
     "reportingOrg": "Organização que reportou",
+    "role": "Papel",
     "scanners": "Análise de spam e vírus",
     "sender": "Remetente",
     "signOutOthers": "Sair dos outros dispositivos",