email, extracted from the officer platform

IMAP and Gmail sync into a per-account SQLite store, with the mail read and
composed in the browser.

moved whole from src/servers/sidecar/email (14 files), src/servers/api/email,
officer_db/src/email, and the Screens/Dashboard/Email tree. what changed on the
way out:

- credentials are encrypted. the column was plaintext jsonb holding an IMAP app
  password that the SMTP transport read straight out of the row; it is now
  AES-256-GCM under this plugin's own 'email' secret-store purpose, sealed and
  opened in queries.ts alone so nothing above it can hold ciphertext by
  accident. no plaintext fallback on read - a value that does not verify is an
  error.
- the router derives its prefix from mountPrefix() instead of the literal
  '/api/email', which was only correct for a first-party publisher.
- the frontend became panels.ts + layout.ts. the two panel appTypes that were
  null are now declared, because the platform screen used to override them by
  panel id and a plugin has no such hook.
- account management became a modal. it was a section in the platform's
  Settings, which a plugin cannot contribute to, and a panel does not work
  either: PluginScreen renders the workspace locked, so a panel outside the
  default layout is unreachable. it follows Compose, which had already solved
  this.
- 17 palette classes replaced with semantic tokens.

not verified: this has never run. it was switched off in the platform on
2026-08-13 and its table was never created, so nothing has exercised sync,
sending or the UI since. the first install is the first test.

manifest.ts

@@ -0,0 +1,33 @@
+import type { PluginManifest } from '@@/plugins/manifest';
+
+// Mail: IMAP and Gmail sync into a per-account SQLite store, read and composed in the browser.
+//
+// Extracted from the platform on 2026-08-17. It was switched off in place on 2026-08-13 along with every
+// other plugin router, and had never been turned back on — so this plugin's first install is also the
+// first time the feature has run in four days. See PLUGIN.md.
+//
+// `appName` is not declared: it is the directory name, so the id cannot disagree with where the code sits.
+export const manifest: PluginManifest = {
+  publisher: 'officerdev',
+  version: '1.0.0',
+  platform: '>=1.0.0',
+
+  label: 'Email',
+  summary: 'IMAP and Gmail accounts, synced locally and searchable offline',
+  icon: 'Mail',
+  color: '#38bdf8',
+
+  // One permission over the whole surface — the mail, the accounts and the compose window are one feature
+  // and there is no useful split where a member may read mail but not manage the account it arrives on.
+  //
+  // Grantable per role at read or write, like every plugin permission. What a grant MEANS is this plugin's
+  // job: `email_accounts` is scoped by `user_id` and every query takes the caller, so a granted member sees
+  // their own accounts rather than the owner's.
+  permissions: [
+    {
+      key: 'email',
+      label: 'Email',
+      description: 'Mail accounts and messages',
+    },
+  ],
+};