Group six more clusters out of web/src/lib

Takes the flat module count from 66 to 42, continuing what admin/ and
calendar/ started.

  lib/mailbox/  archiveDate, emptyFolder, folderMove, labelTree,
                mailboxName, mailboxRoute
  lib/sieve/    sieve, sieveApply, sieveFolders
  lib/input/    keyboard, swipe, touch, listSelection, dropUpload
  lib/notify/   notify, webpush, webpushEnable
  lib/sw/       swCache, swFacts, staleBuild
  lib/text/     html, markdown, text, emlName

FOUR THINGS THE FILENAMES GET WRONG, each checked by reading the file
rather than trusting what it is called:

  - appFolder is not a mailbox. It is the `ihasmail` folder in JMAP
    *Files*, where the client keeps signature images and synced settings.
    It stays flat.
  - format holds no formatting of text. It re-exports the date and clock
    formatters, so it belongs with dates/datetime, not with text/.
  - preview is the file viewer deciding what it can show without
    downloading, and source is where to point someone asking for this
    instance's AGPL source. Neither is about text.
  - notify is not Web Push. It is the tab title, the favicon badge and
    the new-mail sound -- in-app notification, which is why it sits with
    webpush rather than under sw/ with the service worker's own concerns.

threadScroll stays flat too: it decides where a conversation opens, which
is view state rather than a gesture, and input/ is honest only if
everything in it interprets something the reader did.

No behavior change. Almost every reference was on the @/ alias; eight
relative imports in files that did not move, or that moved away from a
sibling, needed rewriting by hand.

web/src/lib/text/emlName.ts

@@ -0,0 +1,50 @@
+/**
+ * A filename for a message saved or attached as `.eml`.
+ *
+ * The rule this replaces was `subject.replace(/[^\w.-]+/g, "_")`, and `\w`
+ * without the `u` flag is ASCII: every character of a Russian, Japanese or
+ * Chinese subject failed the class, so those messages downloaded as a row of
+ * underscores. ihasmail ships in nine languages besides English, so the
+ * subjects it handled worst were most of the world's.
+ *
+ * What is actually unsafe in a filename is a much shorter list than "not
+ * ASCII": the path separators, the characters Windows reserves, and the
+ * control range. Everything else is a letter to somebody.
+ *
+ * The test is written by code point rather than as a character class because
+ * the escaping in one of those is its own small trap, and this says plainly
+ * what it means.
+ */
+
+/** Reserved on Windows, or a path separator. */
+const RESERVED = '<>:"/\\|?*';
+
+function unsafe(ch: string): boolean {
+  const c = ch.codePointAt(0) ?? 0;
+  // C0 controls, and DEL.
+  if (c < 0x20 || c === 0x7f) return true;
+  return RESERVED.includes(ch);
+}
+
+/**
+ * Long enough to stay recognizable, short enough to survive a 255-*byte* limit
+ * once a CJK subject is three bytes a character.
+ */
+const MAX = 80;
+
+/** The stem only, so a caller can put another extension on it. */
+export function sanitizeFilename(subject: string | null | undefined): string {
+  const kept = [...(subject ?? "")].filter((ch) => !unsafe(ch)).join("");
+  return kept
+    // Whitespace becomes an underscore rather than being kept: it is what the
+    // previous rule did, and it saves a quoting question in a shell later.
+    .replace(/\s+/g, "_")
+    .slice(0, MAX)
+    // Windows refuses a name ending in a dot or a space, and a leading dot
+    // hides the file on Unix. Neither is worth inheriting from a subject.
+    .replace(/^[.\s_]+|[.\s_]+$/g, "");
+}
+
+export function emlFilename(subject: string | null | undefined): string {
+  return `${sanitizeFilename(subject) || "message"}.eml`;
+}