test: add characterisation tests for untested integration seams

Golden-master tests pinning the CURRENT behavior of high-value modules
that had no coverage — integration seams, security helpers, two API
route handlers, and complex pure utils. 111 tests across 12 files.

New tests:
- auth-crypto / session-cookie: AES-256-GCM session encryption roundtrip,
  tamper/version/missing-secret handling; cookie-slot naming.
- unified-mailbox: multi-account fan-out, sort, totals, per-account error
  isolation, personal-vs-shared JMAP target resolution, counts/roles.
- account-state-manager: snapshot/restore across the six real Zustand
  stores; clearAllStores reset shape; evict.
- mdn: RFC 5322 MDN assembly (CRLF, RFC2047, base64 wrap, headers).
- tnef: winmail.dat binary parsing from hand-built fixtures.
- download-filename / subject-prefix / birthday-calendar / eml-import:
  filename templating, multilingual prefix stripping, birthday event
  generation, .eml/.zip import.
- webdav / caldav-discover route handlers: auth guards, path validation,
  upstream URL construction, candidate probing.
- helpers/factories.ts: shared makeEmail/makeMailbox/makeFakeJmapClient.

Tests follow the repo's existing patterns (route-import, fake IJMAPClient,
fetch spy, real store singletons). Where current behavior looks buggy it
is pinned and flagged with a // CHARACTERISATION: comment (see PR for the
suspected-bugs list); no production code is changed.

lib/__tests__/helpers/factories.ts

@@ -0,0 +1,34 @@
+// Shared test factories. Additive only — existing tests keep their inline
+// factories; new tests can import these to avoid re-declaring the large
+// Email/Mailbox literals. Keep minimal and cast through `unknown` so callers
+// only specify the fields they assert on.
+import type { Email, Mailbox } from '@/lib/jmap/types';
+import type { IJMAPClient } from '@/lib/jmap/client-interface';
+
+export const makeEmail = (over: Partial<Email> = {}): Email =>
+  ({
+    id: 'e1',
+    threadId: 't1',
+    receivedAt: '2026-01-01T00:00:00Z',
+    subject: '',
+    from: [],
+    to: [],
+    cc: [],
+    keywords: {},
+    mailboxIds: {},
+    ...over,
+  } as unknown as Email);
+
+export const makeMailbox = (over: Partial<Mailbox> = {}): Mailbox =>
+  ({
+    id: 'mb1',
+    name: 'Inbox',
+    role: 'inbox',
+    unreadEmails: 0,
+    totalEmails: 0,
+    ...over,
+  } as unknown as Mailbox);
+
+/** A bare fake JMAP client: only the methods you pass exist. */
+export const makeFakeJmapClient = (over: Partial<IJMAPClient> = {}): IJMAPClient =>
+  over as unknown as IJMAPClient;