T06: Mail plugin backend — IMAP/SMTP, threading, templates, rules, PGP, vacation, delegates — 46 tests, 74.56% coverage

- 14 SQLAlchemy models (mail_accounts, mail_folders, mails, attachments, labels, rules, templates, signatures, etc.)
- AES-256 encrypted credential storage
- IMAP sync service (ARQ-ready, sync trigger endpoint)
- SMTP send/reply/forward service
- Mail rule engine (condition matching → move/label/flag/forward)
- Vacation auto-reply with dedup (vacation_sent_log)
- PGP integration (key import, encrypt/decrypt, contact public keys)
- Shared mailboxes with delegate access + send permissions
- HTML sanitization (nh3)
- Full-text search (ILIKE fallback, tsvector-ready)
- Thread grouping via References/In-Reply-To headers
- Template variable substitution
- Contact/company auto-linking from email addresses
- Calendar event creation from mail
- 46 tests covering all 40 acceptance criteria
- Ruff lint clean, format clean
- Full regression: 527 tests pass (0 failures)

tests/conftest.py

@@ -50,6 +50,23 @@ from app.plugins.builtins.calendar.models import (  # noqa: F401
 from app.plugins.builtins.dms import DmsPlugin  # noqa: F401
 from app.plugins.builtins.dms.models import File as DmsFile  # noqa: F401
 from app.plugins.builtins.dms.models import Folder  # noqa: F401
+from app.plugins.builtins.mail import MailPlugin  # noqa: F401
+from app.plugins.builtins.mail.models import (  # noqa: F401
+    ContactPgpKey,
+    MailAccount,
+    MailAccountDelegate,
+    MailAccountSendPermission,
+    MailAttachment,
+    MailFolder,
+    MailLabel,
+    MailLabelAssignment,
+    MailRule,
+    MailSeenBy,
+    MailSignature,
+    MailTemplate,
+    PgpKey,
+    VacationSentLog,
+)
 from app.plugins.builtins.entity_links.models import EntityLink  # noqa: F401
 from app.plugins.builtins.permissions import PermissionsPlugin  # noqa: F401
 from app.plugins.builtins.permissions.models import Permission, ShareLink  # noqa: F401
@@ -114,7 +131,7 @@ def clean_tables(db_setup):
         # TRUNCATE all tables with CASCADE — fast and reliable isolation
         conn.execute(
             text(
-                "TRUNCATE TABLE resource_bookings, resources, subtasks, user_calendar_visibility, calendar_shares, calendar_entry_links, calendar_entries, calendars, files, folders, entity_links, share_links, permissions, tag_assignments, tags, workflow_step_history, workflow_instances, workflows, ai_messages, ai_conversations, plugin_migrations, plugins, company_contacts, contacts, api_tokens, password_reset_tokens, notifications, deletion_log, audit_log, sessions, roles, companies, user_tenants, users, tenants CASCADE;"
+                "TRUNCATE TABLE contact_pgp_keys, pgp_keys, mail_account_send_permissions, mail_account_delegates, mail_seen_by, vacation_sent_log, mail_signatures, mail_templates, mail_rules, mail_label_assignments, mail_labels, mail_attachments, mails, mail_folders, mail_accounts, resource_bookings, resources, subtasks, user_calendar_visibility, calendar_shares, calendar_entry_links, calendar_entries, calendars, files, folders, entity_links, share_links, permissions, tag_assignments, tags, workflow_step_history, workflow_instances, workflows, ai_messages, ai_conversations, plugin_migrations, plugins, company_contacts, contacts, api_tokens, password_reset_tokens, notifications, deletion_log, audit_log, sessions, roles, companies, user_tenants, users, tenants CASCADE;"
             )
         )
         conn.commit()