every route can name its mailbox, and the list can span them

Multiple accounts were already supported everywhere except where it counted. email_accounts is keyed
(user_id, email), each account syncs into its own emails.db, and IDLE watchers run per account — so three
accounts would all sync happily and only one could ever be read. The assumption lived in two lines:

    store.ts     openUserEmailDb()   accounts.find(a => a.enabled) ?? accounts[0]
    routes.ts    getSmtpTransport()  accounts.find(a => a.enabled) ?? accounts[0]

The first had thirteen callers — every read route. The second decided who sends.

Now `?account=<id>` names one mailbox and `?account=all` spans them. Absent stays the old behaviour, first
enabled, because the mobile app and the agent's email_db tool both call these routes and know nothing about
accounts; making it required would have broken both silently.

ONE DATABASE PER ACCOUNT, and the unified view is a MERGE rather than a join. Not a limitation — emails_fts
is a per-database FTS5 virtual table and MATCH cannot be aimed across an ATTACH boundary through a view, so
a unified search has to be a merge of local searches. The upside is that every SQL string in store.ts is
reused verbatim, searchEmails included, so the operator parser and the OR branching are not reimplemented
for the unified case.

The merge is a distributed top-K and it is exact, not approximate: each mailbox is asked for offset+limit
rows, because a row ranked third locally can belong fortieth globally and anything less leaves a hole in a
later page.

Threads are collapsed per mailbox before merging, deliberately. A conversation does not continue across two
accounts, so local collapse is both cheaper and more correct than any cross-database window function.

Four details worth keeping:

- Routes addressed by an id search the scope for the mailbox HOLDING it. A unified list returns ids from
  every account, so opening the first would 404 on mail plainly on screen. The predicate is `id OR
  thread_id` because these routes take both and the id spaces overlap by design.
- sync-status across mailboxes reports the OLDEST stamp. "Synced as of" is a claim about everything on
  screen and stops being true at the laggard; the freshest would call a unified inbox current while one
  account had not been reached for a day.
- Sending honours the named account and REFUSES an id that is not the caller's, rather than falling back to
  the default. Replying from the wrong account leaks which addresses belong to one person and breaks the
  thread for the recipient.
- queryAcross has no `descending` option. It had one for twenty minutes; a test caught that it flipped the
  merge while every caller's SQL still said ORDER BY date DESC, so asking for the oldest mail returned the
  oldest of the newest page. The requirement — mailboxes hand back newest-first — is now written down and
  pinned by a test that demonstrates the silent wrongness rather than asserting the fix.

UI is next: the picker for switch-or-all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

sidecar/store.ts

@@ -160,12 +160,31 @@ export function openEmailDb(ownerEmail: string, accountEmail: string): Database
 }
 
 /**
- * Open the email DB for a user's configured account. Emails are stored per account
- * (email_accounts/<account>/emails.db); for now we use the user's first account. Returns null if the
- * user has no email account configured yet.
+ * Open ONE mailbox — the account asked for, or the first enabled one when nothing is asked.
+ *
+ * `accountParam` is the `?account=` query value: an account id, `all`, or absent. This used to take no
+ * parameter at all and always answer with the first enabled account, which is how a second mail account
+ * could be added, sync a full database, and never be readable — thirteen routes looked at the first one
+ * and nothing said so.
+ *
+ * `all` resolves to the first account HERE rather than throwing, because the routes that can genuinely
+ * span mailboxes do not come through this function: they use `openScope`/`queryAcross` in `mail-scope.ts`.
+ * A route still using this one is a route whose answer is per mailbox — a contact list, a sync status —
+ * and giving it the first account is the same answer it gave yesterday.
  */
-export async function openUserEmailDb(ownerEmail: string, userId: number): Promise<Database | null> {
+export async function openUserEmailDb(
+  ownerEmail: string,
+  userId: number,
+  accountParam?: string,
+): Promise<Database | null> {
   const accounts = await getEmailAccounts(userId);
+  if (accountParam && accountParam !== 'all') {
+    const id = Number(accountParam);
+    // Scoped to this user by `getEmailAccounts`, so an id belonging to somebody else finds nothing rather
+    // than opening their mail.
+    const asked = Number.isFinite(id) ? accounts.find((a) => a.id === id) : undefined;
+    return asked ? openEmailDb(ownerEmail, asked.email) : null;
+  }
   const account = accounts.find((a) => a.enabled) ?? accounts[0];
   return account ? openEmailDb(ownerEmail, account.email) : null;
 }