fix(i-e): Mail-Suite 46/46 gruen in 94s statt 18:29min — globales IMAP-Mock-Fixture + 3 echte Fixes

Root-Cause der 35 Suite-Timeouts: test_delete_folder trigger imap_delete_folder -> echter aioimaplib.IMAP4_SSL-Connect zu imap.example.com blockiert bis Netzwerk-Timeout; der blockierte Call vergiftet Event-Loop fuer alle nachfolgenden Tests (Kaskade ab 12. Test).

Fixes: (1) tests/conftest.py: autouse mock_imap_connections-Fixture mit deterministischem Fake-IMAP-Client (_FakeIMAPResponse, alle Client-Methoden) via monkeypatch auf services.aioimaplib.IMAP4_SSL. (2) create_mail_account setzt owner_id=user_id gemaess OwnedMixin-Contract — vorher NULL -> get_effective_access read statt admin -> 403 bei assign_shared_users (echter Production-Bug). (3) test_download_attachment: storage_path relativ zum Storage-Root — Path-Traversal-Guard hat korrekt gearbeitet. (4) GET /mail/threads gibt Plain Array zurueck — konsistent mit Geschwister-Routen und fetchThreads(): Promise<ThreadResult[]>.

Beweise: 46/46 passed in 94.41s (vorher 1 failed, 10 passed, 35 errors in 1109.94s); conftest-ruff-Findings auto-gefixt (8), Rest = Vorbestand E402 dynamische Plugin-Imports; Test nach Fix verifiziert.

tests/test_mail.py

@@ -489,8 +489,12 @@ async def test_download_attachment(mail_authed_client, db_session):
     mail = await _create_mail_direct(
         db_session, seed["tenant_a"].id, uuid.UUID(account["id"]), uuid.UUID(folder["id"])
     )
-    # Create attachment
-    test_file_path = f"/tmp/mail_test_{uuid.uuid4()}.txt"
+    # Create attachment — production stores files RELATIVE to the storage root
+    # (/data/uploads); absolute paths are correctly rejected by the
+    # path-traversal guard in LocalStorage._full_path.
+    test_file_name = f"mail_test_{uuid.uuid4()}.txt"
+    storage_root = os.environ.get("STORAGE_PATH", "/data/uploads")
+    test_file_path = os.path.join(storage_root, test_file_name)
     with open(test_file_path, "w") as f:
         f.write("attachment content")
     att = MailAttachment(
@@ -499,7 +503,7 @@ async def test_download_attachment(mail_authed_client, db_session):
         filename="test.txt",
         mime_type="text/plain",
         size_bytes=17,
-        storage_path=test_file_path,
+        storage_path=test_file_name,
     )
     db_session.add(att)
     await db_session.commit()