fix: mail plugin CSRF token handling and trailing slash

- Add CSRF token storage in sessionStorage (persists across reloads)
- Send X-CSRF-Token header on POST/PATCH/DELETE requests
- Store CSRF token on login, clear on logout
- Fix trailing slash in mail list API call (/mail/ -> /mail)

frontend/src/api/hooks.ts

@@ -1,5 +1,5 @@
 import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
-import { apiPost, apiGet, apiPatch, apiDelete, apiClient } from './client';
+import { apiPost, apiGet, apiPatch, apiDelete, apiClient, setCsrfToken } from './client';
 import { useAuthStore } from '@/store/authStore';
 
 export interface LoginPayload {
@@ -112,6 +112,10 @@ export function useLogin() {
     onSuccess: (data: any) => {
       setUser(data.user || data);
       setError(null);
+      // Store CSRF token for subsequent unsafe requests
+      if (data.csrf_token) {
+        setCsrfToken(data.csrf_token);
+      }
     },
     onError: (error: any) => {
       setError(error.message || 'Login failed');
@@ -126,6 +130,7 @@ export function useLogout() {
     mutationFn: () => apiPost('/auth/logout'),
     onSettled: () => {
       logout();
+      setCsrfToken(null);
       queryClient.clear();
     },
   });