P1 fixes: outbox no_handlers, HTML sanitization, WebSocket plugin check, fail-closed plugin gate, plugin admin-only

app/commands/mail_commands.py

@@ -13,6 +13,7 @@ from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.commands.base import BaseCommand, CommandResult
 from app.core.outbox import enqueue_outbox_event
+from app.plugins.builtins.mail.services import sanitize_html
 
 logger = logging.getLogger(__name__)
 
@@ -62,7 +63,7 @@ class SendMailCommand(BaseCommand):
             cc_addr=",".join(self.cc) if self.cc else None,
             subject=self.subject,
             body_text=self.body_text,
-            body_html_sanitized=self.body_html,
+            body_html_sanitized=sanitize_html(self.body_html) if self.body_html else None,
             direction="outgoing",
             received_at=datetime.now(UTC),
             is_read=True,