email, extracted from the officer platform

IMAP and Gmail sync into a per-account SQLite store, with the mail read and
composed in the browser.

moved whole from src/servers/sidecar/email (14 files), src/servers/api/email,
officer_db/src/email, and the Screens/Dashboard/Email tree. what changed on the
way out:

- credentials are encrypted. the column was plaintext jsonb holding an IMAP app
  password that the SMTP transport read straight out of the row; it is now
  AES-256-GCM under this plugin's own 'email' secret-store purpose, sealed and
  opened in queries.ts alone so nothing above it can hold ciphertext by
  accident. no plaintext fallback on read - a value that does not verify is an
  error.
- the router derives its prefix from mountPrefix() instead of the literal
  '/api/email', which was only correct for a first-party publisher.
- the frontend became panels.ts + layout.ts. the two panel appTypes that were
  null are now declared, because the platform screen used to override them by
  panel id and a plugin has no such hook.
- account management became a modal. it was a section in the platform's
  Settings, which a plugin cannot contribute to, and a panel does not work
  either: PluginScreen renders the workspace locked, so a panel outside the
  default layout is unreachable. it follows Compose, which had already solved
  this.
- 17 palette classes replaced with semantic tokens.

not verified: this has never run. it was switched off in the platform on
2026-08-13 and its table was never created, so nothing has exercised sync,
sending or the UI since. the first install is the first test.

sidecar/email-cron.ts

@@ -0,0 +1,45 @@
+import { getUserById } from 'officerdb';
+import { getAllSyncedAccounts } from '../db/queries';
+import { performResync } from './resync';
+
+const INTERVAL_MS = 10 * 60 * 1000; // 10 minutes
+
+let timer: ReturnType<typeof setInterval> | null = null;
+
+async function tick() {
+  try {
+    const accounts = await getAllSyncedAccounts();
+    if (accounts.length === 0) return;
+
+    for (const account of accounts) {
+      const user = await getUserById(account.userId);
+      if (!user) continue;
+
+      try {
+        console.log(`[email-cron] Resyncing ${account.email}`);
+        const result = await performResync({ accountId: account.id, userEmail: user.email, userId: user.id });
+        if (result.saved > 0) {
+          console.log(`[email-cron] ${account.email}: ${result.saved} new emails`);
+        }
+      } catch (err) {
+        console.error(`[email-cron] Failed to resync ${account.email}:`, err instanceof Error ? err.message : err);
+      }
+    }
+  } catch (err) {
+    console.error('[email-cron] Error:', err instanceof Error ? err.message : err);
+  }
+}
+
+export function initEmailCron() {
+  if (timer) return;
+  console.log(`[email-cron] Starting email sync cron (every ${INTERVAL_MS / 60_000} min)`);
+  timer = setInterval(tick, INTERVAL_MS);
+  setTimeout(tick, 30_000);
+}
+
+export function stopEmailCron() {
+  if (timer) {
+    clearInterval(timer);
+    timer = null;
+  }
+}