fix: mail plugin CSRF token handling and trailing slash

- Add CSRF token storage in sessionStorage (persists across reloads)
- Send X-CSRF-Token header on POST/PATCH/DELETE requests
- Store CSRF token on login, clear on logout
- Fix trailing slash in mail list API call (/mail/ -> /mail)

frontend/src/api/mail.ts

@@ -401,7 +401,7 @@ export function deleteFolder(folderId: string): Promise<void> {
 
 export function fetchMails(folderId: string, page: number): Promise<MailListResult> {
   const qs = new URLSearchParams({ folder_id: folderId, page: String(page) }).toString();
-  return apiGet<MailListResult>(`/mail/?${qs}`);
+  return apiGet<MailListResult>(`/mail?${qs}`);
 }
 
 export function getMail(mailId: string): Promise<Mail> {