Harden sync, email, plugin, and export subsystems
Fix email and OAuth handling: IMAP UIDs, URL decoding, is_read flag
Audit remediation: observability, adversarial fixes, JS tests, doc comments
Initial commit