email, extracted from the officer platform

IMAP and Gmail sync into a per-account SQLite store, with the mail read and
composed in the browser.

moved whole from src/servers/sidecar/email (14 files), src/servers/api/email,
officer_db/src/email, and the Screens/Dashboard/Email tree. what changed on the
way out:

- credentials are encrypted. the column was plaintext jsonb holding an IMAP app
  password that the SMTP transport read straight out of the row; it is now
  AES-256-GCM under this plugin's own 'email' secret-store purpose, sealed and
  opened in queries.ts alone so nothing above it can hold ciphertext by
  accident. no plaintext fallback on read - a value that does not verify is an
  error.
- the router derives its prefix from mountPrefix() instead of the literal
  '/api/email', which was only correct for a first-party publisher.
- the frontend became panels.ts + layout.ts. the two panel appTypes that were
  null are now declared, because the platform screen used to override them by
  panel id and a plugin has no such hook.
- account management became a modal. it was a section in the platform's
  Settings, which a plugin cannot contribute to, and a panel does not work
  either: PluginScreen renders the workspace locked, so a panel outside the
  default layout is unreachable. it follows Compose, which had already solved
  this.
- 17 palette classes replaced with semantic tokens.

not verified: this has never run. it was switched off in the platform on
2026-08-13 and its table was never created, so nothing has exercised sync,
sending or the UI since. the first install is the first test.

sidecar/imap-validate.ts

@@ -0,0 +1,54 @@
+type ValidateImapParams = {
+  host: string;
+  port: number;
+  secure: boolean;
+  user: string;
+  pass?: string;
+  accessToken?: string;
+};
+
+type ValidateImapResult = { ok: true; folderCount: number } | { ok: false; error: string };
+
+export async function validateImapConnection(params: ValidateImapParams): Promise<ValidateImapResult> {
+  const { ImapFlow } = await import('imapflow');
+
+  const auth: { user: string; pass?: string; accessToken?: string } = { user: params.user };
+  if (params.accessToken) {
+    auth.accessToken = params.accessToken;
+  } else if (params.pass) {
+    auth.pass = params.pass;
+  } else {
+    return { ok: false, error: 'No authentication credentials provided' };
+  }
+
+  const client = new ImapFlow({
+    host: params.host,
+    port: params.port,
+    secure: params.secure,
+    auth,
+    logger: false,
+    greetingTimeout: 60_000,
+    socketTimeout: 60_000,
+  });
+
+  try {
+    const result = await Promise.race([
+      (async () => {
+        await client.connect();
+        const folders = await client.list();
+        await client.logout();
+        return { ok: true as const, folderCount: folders.length };
+      })(),
+      new Promise<ValidateImapResult>((_, reject) =>
+        setTimeout(() => reject(new Error('Connection timed out')), 90_000),
+      ),
+    ]);
+    return result;
+  } catch (err) {
+    try {
+      client.close();
+    } catch {}
+    const message = err instanceof Error ? err.message : 'Connection failed';
+    return { ok: false, error: message };
+  }
+}