- Fix FlagUpdatePayload field names to match backend schema (is_seen/is_flagged)
- Replace dangerouslySetInnerHTML with sandboxed iframe (srcDoc, sandbox="")
- Add bulk mark read/unread with checkbox selection in MailList
- Add floating bulk action bar in Mail.tsx
- Add imap_sync_mail_flags() to push Seen/Flagged flags to IMAP server
- Call IMAP flag sync in PATCH /flags endpoint
- Add i18n keys for bulk actions (de/en)
- Add CSRF token storage in sessionStorage (persists across reloads)
- Send X-CSRF-Token header on POST/PATCH/DELETE requests
- Store CSRF token on login, clear on logout
- Fix trailing slash in mail list API call (/mail/ -> /mail)