feat(audit): P1 cross-tenant/RBAC tests, P3 test fixes, P2/P3 frontend fixes

- P1-Tests: 12 test files with new cross-tenant isolation + RBAC tests
- P3-Tests: 8 fixes (duplicate fixtures, sys.path.insert, unused imports, KeyError)
- P3-Frontend: LucideIcons → ICON_MAP (2 files), inline styles → Tailwind (2 files)
- P3-Frontend: DOMPurify for iframe XSS, redundant regex removed, console.log → console.debug
- P2-Frontend: 2 notification API TODOs retained (requires larger refactor)
- conftest.py: create_no_perm_user helper added
- pyproject.toml: pythonpath for scripts/ added
- All checks green: ruff 0, F821 0, tsc 0, app 495 routes, cross-plugin 0

frontend/src/components/mail/MailDetail.tsx

@@ -1,4 +1,3 @@
-// TODO: P3-F7 — Sanitize iframe HTML rendering to prevent XSS
 /**
  * Mail detail reading pane.
  * Shows mail headers, sanitized HTML body, and attachments.
@@ -13,6 +12,7 @@ import { Button } from '@/components/ui/Button';
 import { EmptyState } from '@/components/ui/EmptyState';
 import { FileText, Loader2 } from 'lucide-react';
 import { formatDateTime } from '@/utils/date';
+import DOMPurify from 'dompurify';
 
 export interface MailDetailProps {
   mail: Mail | null; loading: boolean;
@@ -49,7 +49,8 @@ export function MailDetail({
 
   const safeHtml = useMemo(() => {
     if (!mail) return null;
-    return mail.sanitized_html || mail.body_html;
+    const html = mail.sanitized_html || mail.body_html;
+    return html ? DOMPurify.sanitize(html) : null;
   }, [mail]);
 
   const iframeRef = useRef<HTMLIFrameElement>(null);

frontend/src/components/mail/MailList.tsx

@@ -59,8 +59,8 @@ function GroupSection({
   return (
     <li className="bg-secondary-50/30">
       <div
-        className="flex items-center gap-2 px-3 py-2 bg-secondary-100/70 cursor-pointer hover:bg-secondary-100"
-        style={{ paddingLeft: `${level * 12 + 12}px` }}
+        className="flex items-center gap-2 px-3 py-2 bg-secondary-100/70 cursor-pointer hover:bg-secondary-100 pl-[var(--mail-group-pl)]"
+        style={{ ['--mail-group-pl' as string]: `${level * 12 + 12}px` }}
         onClick={() => setCollapsed(!collapsed)}
       >
         {collapsed ? (