feat: mail phase 1 - HTML iframe display, bulk read/unread, IMAP flag sync

- Fix FlagUpdatePayload field names to match backend schema (is_seen/is_flagged)
- Replace dangerouslySetInnerHTML with sandboxed iframe (srcDoc, sandbox="")
- Add bulk mark read/unread with checkbox selection in MailList
- Add floating bulk action bar in Mail.tsx
- Add imap_sync_mail_flags() to push Seen/Flagged flags to IMAP server
- Call IMAP flag sync in PATCH /flags endpoint
- Add i18n keys for bulk actions (de/en)

app/plugins/builtins/mail/services.py

@@ -1295,3 +1295,111 @@ def label_to_response(label: MailLabel) -> dict:
         "name": label.name,
         "color": label.color,
     }
+
+
+# ─── IMAP Flag Sync ───
+
+
+async def imap_sync_mail_flags(
+    db: AsyncSession,
+    mail_id: uuid.UUID,
+    tenant_id: uuid.UUID,
+) -> None:
+    """Sync is_seen/is_flagged flags from DB to IMAP server.
+
+    Connects to the IMAP server, selects the mail's folder,
+    and uses UID STORE to set/remove \\Seen and \\Flagged flags.
+    Non-critical: logs warnings on failure but does not raise.
+    """
+    import logging
+
+    logger = logging.getLogger(__name__)
+
+    # Load the mail with its folder and account
+    mail = (
+        await db.execute(
+            select(Mail).where(
+                and_(Mail.id == mail_id, Mail.tenant_id == tenant_id)
+            )
+        )
+    ).scalar_one_or_none()
+    if not mail:
+        logger.warning("imap_sync_mail_flags: mail %s not found", mail_id)
+        return
+
+    folder = (
+        await db.execute(
+            select(MailFolder).where(
+                and_(MailFolder.id == mail.folder_id, MailFolder.tenant_id == tenant_id)
+            )
+        )
+    ).scalar_one_or_none()
+    if not folder:
+        logger.warning("imap_sync_mail_flags: folder %s not found for mail %s", mail.folder_id, mail_id)
+        return
+
+    account = (
+        await db.execute(
+            select(MailAccount).where(
+                and_(MailAccount.id == folder.account_id, MailAccount.tenant_id == tenant_id)
+            )
+        )
+    ).scalar_one_or_none()
+    if not account:
+        logger.warning("imap_sync_mail_flags: account not found for mail %s", mail_id)
+        return
+
+    if not mail.message_id:
+        logger.warning("imap_sync_mail_flags: mail %s has no message_id, cannot sync", mail_id)
+        return
+
+    password = await get_account_password(account)
+    client = None
+
+    try:
+        client = aioimaplib.IMAP4_SSL(host=account.imap_host, port=account.imap_port)
+        await client.wait_hello_from_server()
+        await client.login(account.username, password)
+
+        # Select the folder
+        select_resp = await client.select(folder.imap_name)
+        if select_resp.result != 'OK':
+            logger.warning("imap_sync_mail_flags: cannot select folder %s", folder.imap_name)
+            return
+
+        # Find the UID by searching for the Message-ID header
+        search_resp = await client.uid_search(f'HEADER Message-ID "{mail.message_id}"')
+        uids_raw = search_resp[1][0] if search_resp[1] and search_resp[1][0] else b''
+        if isinstance(uids_raw, (bytes, bytearray)):
+            uids = uids_raw.split()
+        else:
+            uids = []
+
+        if not uids:
+            logger.warning("imap_sync_mail_flags: no UID found for Message-ID %s", mail.message_id)
+            return
+
+        uid_str = uids[0].decode() if isinstance(uids[0], bytes) else str(uids[0])
+
+        # Sync \Seen flag
+        if mail.is_seen:
+            await client.uid('store', uid_str, '+FLAGS (\\Seen)')
+        else:
+            await client.uid('store', uid_str, '-FLAGS (\\Seen)')
+
+        # Sync \Flagged flag
+        if mail.is_flagged:
+            await client.uid('store', uid_str, '+FLAGS (\\Flagged)')
+        else:
+            await client.uid('store', uid_str, '-FLAGS (\\Flagged)')
+
+        logger.info("imap_sync_mail_flags: synced flags for mail %s (UID %s)", mail_id, uid_str)
+
+    except Exception as exc:
+        logger.warning("imap_sync_mail_flags: failed for mail %s: %s", mail_id, exc)
+    finally:
+        if client is not None:
+            try:
+                await client.logout()
+            except Exception:
+                pass