email, extracted from the officer platform

IMAP and Gmail sync into a per-account SQLite store, with the mail read and
composed in the browser.

moved whole from src/servers/sidecar/email (14 files), src/servers/api/email,
officer_db/src/email, and the Screens/Dashboard/Email tree. what changed on the
way out:

- credentials are encrypted. the column was plaintext jsonb holding an IMAP app
  password that the SMTP transport read straight out of the row; it is now
  AES-256-GCM under this plugin's own 'email' secret-store purpose, sealed and
  opened in queries.ts alone so nothing above it can hold ciphertext by
  accident. no plaintext fallback on read - a value that does not verify is an
  error.
- the router derives its prefix from mountPrefix() instead of the literal
  '/api/email', which was only correct for a first-party publisher.
- the frontend became panels.ts + layout.ts. the two panel appTypes that were
  null are now declared, because the platform screen used to override them by
  panel id and a plugin has no such hook.
- account management became a modal. it was a section in the platform's
  Settings, which a plugin cannot contribute to, and a panel does not work
  either: PluginScreen renders the workspace locked, so a panel outside the
  default layout is unreachable. it follows Compose, which had already solved
  this.
- 17 palette classes replaced with semantic tokens.

not verified: this has never run. it was switched off in the platform on
2026-08-13 and its table was never created, so nothing has exercised sync,
sending or the UI since. the first install is the first test.

web/panels.ts

@@ -0,0 +1,17 @@
+import type { AppRegistryMeta } from 'officerdev';
+import { Inbox, Mail, MessageSquare } from 'lucide-react';
+import { EmailList } from './EmailList';
+import { EmailReader } from './EmailReader';
+import { EmailChatPanel } from './EmailChatPanel';
+
+// `panels.ts`, not `.tsx` — discovery checks for that exact name and refuses the plugin by name if it is
+// missing, so the JSX lives in EmailChatPanel.tsx and this file stays a declaration.
+//
+// No component re-exports: the shell mounts these by key, and there is no way to export a component from a
+// plugin. `availableOnPanel: false` throughout, because PluginScreen renders the workspace `locked` — these
+// are not swappable, and offering them in a picker would be a lie.
+export const appRegistryMetas: AppRegistryMeta[] = [
+  { key: 'email-list', name: 'Mail', icon: Inbox, component: EmailList, availableOnPanel: false },
+  { key: 'email-reader', name: 'Message', icon: Mail, component: EmailReader, availableOnPanel: false },
+  { key: 'email-chat', name: 'Email chat', icon: MessageSquare, component: EmailChatPanel, availableOnPanel: false },
+];