ihasmail 2.0: rebuild as Stalwart-first JMAP webmail

Replace the FastAPI/HTMX prototype with a Node/Hono session proxy and a
React 19/Vite SPA. Mail (conversation view, search operators, labels,
sanitised HTML, privacy image proxy, invites, undo send, templates),
calendar (month/week/day/agenda, invites, free/busy, categories,
context menus), contacts (JSContact, groups, vCard), files, Sieve filter
builder (incl. filter-from-message with retroactive apply), vacation,
identities with default + Reply-To, PWA/mobile layout, push via SSE,
in-memory mock Stalwart for dev, Docker + CI.

server/src/ratelimit.ts

@@ -0,0 +1,45 @@
+/** Simple sliding-window rate limiter keyed by arbitrary string (ip, ip+user). */
+export class RateLimiter {
+  private hits = new Map<string, number[]>();
+
+  constructor(
+    private readonly max: number,
+    private readonly windowMs: number,
+  ) {
+    const t = setInterval(() => this.prune(), windowMs);
+    t.unref();
+  }
+
+  /** Returns true if the action is allowed, false if the caller should back off. */
+  check(key: string): boolean {
+    const now = Date.now();
+    const arr = (this.hits.get(key) ?? []).filter((t) => now - t < this.windowMs);
+    if (arr.length >= this.max) {
+      this.hits.set(key, arr);
+      return false;
+    }
+    arr.push(now);
+    this.hits.set(key, arr);
+    return true;
+  }
+
+  reset(key: string): void {
+    this.hits.delete(key);
+  }
+
+  retryAfterSeconds(key: string): number {
+    const arr = this.hits.get(key);
+    if (!arr || !arr.length) return 0;
+    const oldest = arr[0]!;
+    return Math.max(1, Math.ceil((this.windowMs - (Date.now() - oldest)) / 1000));
+  }
+
+  private prune(): void {
+    const now = Date.now();
+    for (const [k, arr] of this.hits) {
+      const kept = arr.filter((t) => now - t < this.windowMs);
+      if (kept.length) this.hits.set(k, kept);
+      else this.hits.delete(k);
+    }
+  }
+}