ihasmail 2.0: rebuild as Stalwart-first JMAP webmail

Replace the FastAPI/HTMX prototype with a Node/Hono session proxy and a
React 19/Vite SPA. Mail (conversation view, search operators, labels,
sanitised HTML, privacy image proxy, invites, undo send, templates),
calendar (month/week/day/agenda, invites, free/busy, categories,
context menus), contacts (JSContact, groups, vCard), files, Sieve filter
builder (incl. filter-from-message with retroactive apply), vacation,
identities with default + Reply-To, PWA/mobile layout, push via SSE,
in-memory mock Stalwart for dev, Docker + CI.

.env.example

@@ -0,0 +1,35 @@
+# ---- ihasmail server configuration ----
+
+# Base URL of your Stalwart server (scheme + host, no path). ihasmail discovers
+# the JMAP session at <STALWART_URL>/.well-known/jmap.
+STALWART_URL=https://mail.example.com
+
+# Random secret used to derive encryption keys for persisted sessions.
+# Generate with: openssl rand -base64 48
+APP_SECRET=change-me
+
+# Listen address
+HOST=0.0.0.0
+PORT=8080
+
+# Set to "1" when running behind a TLS-terminating reverse proxy (trusts
+# X-Forwarded-* and marks cookies Secure). Set to "0" for plain-HTTP dev.
+TRUST_PROXY=1
+SECURE_COOKIES=auto
+
+# Session lifetime (idle timeout) in seconds. "Remember me" extends to SESSION_REMEMBER_TTL.
+SESSION_TTL=43200
+SESSION_REMEMBER_TTL=2592000
+
+# Where to persist sessions so restarts don't log everyone out (optional).
+SESSION_FILE=./data/sessions.json
+
+# Upstream timeouts / limits
+UPSTREAM_TIMEOUT=30000
+MAX_UPLOAD_BYTES=52428800
+
+# Remote-image privacy proxy (Gmail-style). Set to 0 to load remote images directly.
+IMAGE_PROXY=1
+
+# Branding
+APP_NAME=ihasmail