JMAP client + facade integration (mail v1)

[joyider]

JMAP client + facade integration

Wire Hugin up to Solutrix mail over JMAP (RFC 8620 Core + RFC 8621 Mail).
The backend exposes a JMAP server as a thin facade over the Solutrix mail API,
so all server-side policy (outbound protection, delegation, From handling)
stays in the backend — Hugin is a standard spec-compliant JMAP client.

Client scope (v1)

• Session — fetch /.well-known/jmap, read capabilities + apiUrl.
• Read — Mailbox/get · Mailbox/query; Email/get · Email/query;
  Thread/get. Blob download for attachments.
• Act — Email/set (flag / move / mark seen / delete-to-Trash).
• Send — EmailSubmission/set (server applies its own send policy).
• Push — subscribe to JMAP push (EventSource) for live updates.
• Sync — Email/changes when available; fall back to refetch
  (Email/query + Email/get) when the server returns
  cannotCalculateChanges. Full changes/queryChanges can follow in v1.1.

Authentication (OIDC)

JMAP does not standardise login — it only wants a Bearer token. Hugin obtains
one from the Solutrix IdP:

• OIDC Authorization Code + PKCE (RFC 7636) — public client, no secret.
  Open the system browser / secure webview for the redirect.
• Send Authorization: Bearer <access_token> on the Session + API calls.
• On 401, refresh via the IdP and retry.
• Store the refresh token in the OS credential store (Keychain / Keystore /
  desktop secret store) — never plaintext. Short access token + refresh.

Depends on

• Backend JMAP facade (tracked in the backend project). This issue covers the
  Hugin client side + the auth flow; the two land together.

Open questions

• Calendar: Hugin is a mail and calendar client. JMAP Calendars
  (RFC 9610) vs CalDAV for the calendar side — decide separately; not required
  for the mail v1.
• Attachment/blob upload flow for composing with attachments.

License

Keep EUPL-1.2 clean — Hugin's own additions in separate files; no proprietary
upstream parts.