fix(i-d): mail-API-Brueche behoben — signatures PATCH/DELETE + labels DELETE im Backend ergaenzt, drafts PATCH->PUT

Root-Cause: Frontend-Komponenten (SignatureManager, LabelManager) rufen Endpunkte auf die das Backend nie hatte (404/405 in Production). Anders als ai/sessions sind diese Funktionen ECHT in Komponenten eingebunden -> Backend-Routen nachbestellt statt Frontend-Calls zu loeschen:

(1) PATCH+DELETE /mail/signatures/{id}: MailSignatureUpdate-Schema neu, Tenant-Scoped + Owner-Check (403 bei fremder Signatur), is_default-Exklusivitaet beim Setzen. (2) DELETE /mail/labels/{id}: gleicher Stil. (3) updateDraft Frontend: apiPatch -> apiPut (Backend hat PUT /drafts/{id} bereits). Beweistest tests/test_mail_sig_label_routes.py 5/5 gruen (PATCH-Werte, DELETE+Liste-leer, 404-Faelle).

Verifikation: create_app registriert beide neuen Routen (563 total); ruff clean; tsc exit=0.

frontend/src/api/policies.ts

@@ -1,124 +0,0 @@
-/**
- * ABAC Policy API client.
- *
- * All requests use the shared `apiClient` (`baseURL: '/api/v1'`) and target
- * the Policies routes under `/policies/...`.
- */
-
-import { apiDelete, apiGet, apiPost, apiPut } from './client';
-
-// ─── Types ─────────────────────────────────────────────────────────────────
-
-export type PrincipalType = 'user' | 'group' | 'role';
-
-export type ConditionOperator =
-  | 'eq'
-  | 'neq'
-  | 'in'
-  | 'gt'
-  | 'gte'
-  | 'lt'
-  | 'lte'
-  | 'contains'
-  | 'starts_with'
-  | 'is_null';
-
-export type ConditionGroupLogic = 'AND' | 'OR';
-
-export interface Condition {
-  id?: string;
-  field: string;
-  operator: ConditionOperator;
-  value: string;
-}
-
-export interface ConditionGroup {
-  id?: string;
-  logic: ConditionGroupLogic;
-  conditions: Condition[];
-  groups?: ConditionGroup[];
-}
-
-export interface ABACPolicy {
-  id: string;
-  name: string;
-  entity_type: string;
-  principal_type: PrincipalType;
-  principal_id: string;
-  principal_name?: string | null;
-  effect: 'allow' | 'deny';
-  conditions: ConditionGroup | null;
-  priority: number;
-  enabled: boolean;
-  created_at?: string | null;
-  updated_at?: string | null;
-}
-
-export interface PolicyListResponse {
-  items: ABACPolicy[];
-  total: number;
-}
-
-export interface CreatePolicyPayload {
-  name: string;
-  principal_type: PrincipalType;
-  principal_id: string;
-  effect: 'allow' | 'deny';
-  conditions: ConditionGroup | null;
-  priority: number;
-  enabled: boolean;
-}
-
-export interface UpdatePolicyPayload {
-  name?: string;
-  principal_type?: PrincipalType;
-  principal_id?: string;
-  effect?: 'allow' | 'deny';
-  conditions?: ConditionGroup | null;
-  priority?: number;
-  enabled?: boolean;
-}
-
-// ─── API Functions ─────────────────────────────────────────────────────────
-
-/**
- * Fetch all policies for a given entity type.
- */
-export function fetchPolicies(entityType: string): Promise<PolicyListResponse> {
-  return apiGet<PolicyListResponse>(`/policies/${entityType}`);
-}
-
-/**
- * Fetch a single policy by ID.
- */
-export function fetchPolicy(entityType: string, policyId: string): Promise<ABACPolicy> {
-  return apiGet<ABACPolicy>(`/policies/${entityType}/${policyId}`);
-}
-
-/**
- * Create a new policy for the given entity type.
- */
-export function createPolicy(
-  entityType: string,
-  payload: CreatePolicyPayload
-): Promise<ABACPolicy> {
-  return apiPost<ABACPolicy>(`/policies/${entityType}`, payload);
-}
-
-/**
- * Update an existing policy.
- */
-export function updatePolicy(
-  entityType: string,
-  policyId: string,
-  payload: UpdatePolicyPayload
-): Promise<ABACPolicy> {
-  return apiPut<ABACPolicy>(`/policies/${entityType}/${policyId}`, payload);
-}
-
-/**
- * Delete a policy.
- */
-export function deletePolicy(entityType: string, policyId: string): Promise<void> {
-  return apiDelete<void>(`/policies/${entityType}/${policyId}`);
-}