fix(jmap): CSP blocked wss:, WS circuit breaker too slow to trip

Two real bugs in the previous WS-push commit, both found while building the
integration test for it (not theoretical - each reproduced and verified
before and after the fix):

1. proxy.ts's production CSP (`connect-src 'self' https:`) has no `wss:`
   term, so `new WebSocket(...)` was blocked before any network attempt at
   all - confirmed by listening for `securitypolicyviolation` against the
   real reference server (stalwart.sandbox.vnc.de, HTTPS): the WS feature
   was entirely inert in a production build, for every server, not just
   ones with an incompatible auth model. Fixed by adding `wss:` alongside
   `https:` in production - no new trust surface, since `https:` here
   already allows fetch/XHR to any TLS host (needed for
   ALLOW_CUSTOM_JMAP_ENDPOINT / multi-server setups), so extending that same
   model to WebSocket is consistent, not a new precedent. Verified after the
   fix: the same probe now reaches the network and gets a real (expected)
   auth rejection from Stalwart instead of a CSP block.

2. lib/jmap/client.ts's circuit breaker (5 attempts, 1s/30s backoff) could
   take up to ~31s to give up on WS and fall back to SSE. Against a server
   that fails the handshake instantly and deterministically every time (the
   auth-header limitation documented in the previous commit), that's ~31s
   of NO live push at all - WS hasn't succeeded and hasn't given up yet, so
   SSE never starts connecting, and any mail delivered in that window was
   silently missed (SSE only streams changes from the moment it connects,
   no catch-up). Reproduced directly: a real SMTP delivery sent during that
   window never reached the notification bridge.

   Fixed two ways:
     - Tightened the ladder to a 200ms base / 5s cap / 3-attempt circuit
       breaker (worst case ~1.75s instead of ~31s) - still genuine
       exponential-with-jitter backoff, just tuned for a failure mode that's
       fast and deterministic rather than slow and flaky. A slow/real
       network issue is unaffected: a hanging attempt is still bounded by
       the browser's own WebSocket connect timeout, not by these constants.
     - setupPushNotifications() now primes a polling baseline
       (fetchCurrentStates()) in parallel with the WS attempt, and
       fallbackFromWebSocket() diffs against it (checkForStateChanges())
       BEFORE connectSSE()/startPollingFallback() get a chance to erase that
       opportunity. This is what actually closes the gap rather than just
       shrinking it: it catches a change that happened to the primary
       account during the (now much shorter) WS retry window.

electron/main.ts also gets a test-only escape hatch (ELECTRON_LOAD_URL): set
it to skip spawning the standalone server and load that URL instead. Real
users and every packaging/CI path never set it - added because verifying
the fixes above against this repo's own local Stalwart fixture (deliberately
plaintext HTTP - integration/webmail.Dockerfile makes the identical
trade-off for the browser-based suite) needs a dev-mode Next.js server
(proxy.ts only widens connect-src for plain http/ws in dev), not the
production standalone build electron/main.ts normally boots.

next.config.ts: added 127.0.0.1 to allowedDevOrigins alongside the existing
LAN entry - electron/main.ts always loads its window at 127.0.0.1, so a
dev-mode Electron run (only used by the escape hatch above) needs it in this
allowlist the same as any other cross-origin dev client would.

Verified: full lib/__tests__ JMAP suite still green (158/158); npm run
test:electron still green (4/4); the raw WebSocket probe against the real
sandbox now reaches the network post-fix instead of being CSP-blocked.

electron/main.ts

@@ -112,7 +112,17 @@ function stopStandaloneServer(): void {
 }
 
 async function createMainWindow(): Promise<void> {
-  const url = await startStandaloneServer();
+  // Test-only escape hatch: when set, skip spawning the standalone server
+  // entirely and load this URL instead. Used by
+  // integration/tests/11-electron-notification.spec.ts, which needs a
+  // dev-mode Next.js server (proxy.ts's CSP only widens connect-src to
+  // allow plain-HTTP/ws JMAP in dev - see that file's comments) to reach
+  // the integration fixture's deliberately-plaintext local Stalwart,
+  // exactly the same trade-off integration/webmail.Dockerfile already makes
+  // for the browser-based integration suite. Never set by real users or by
+  // any of the packaging/CI paths - those always go through
+  // startStandaloneServer() below.
+  const url = process.env.ELECTRON_LOAD_URL || (await startStandaloneServer());
 
   mainWindow = new BrowserWindow({
     width: 1280,
@@ -133,18 +143,26 @@ async function createMainWindow(): Promise<void> {
 }
 
 // --- Native notification bridge --------------------------------------------
-// Called from the preload's `window.vnc.showNotification` (electron/preload.ts).
-// Electron's own Notification API is the desktop shell's notification path -
-// it sits alongside, not in place of, the browser/PWA's service-worker push
-// path (public/sw.js's `push`/`notificationclick` handlers + lib/web-push.ts).
-// Which of the two actually gets wired up to real mail-delivery events is a
-// separate decision (VNCprodbuild Phase 1 steps 4-6); this handler is just
-// the plumbing that lets the renderer trigger a native OS notification at
-// all, so it can be exercised end-to-end from a smoke test now instead of
-// bolted on untested later.
+// Called from the preload's `window.vnc.showNotification` (electron/preload.ts),
+// itself called from lib/electron-bridge.ts's showElectronNotification(),
+// itself called from app/(main)/[locale]/page.tsx's "new mail arrived"
+// effect whenever lib/jmap/client.ts's push pipeline (WebSocket, or its SSE/
+// polling fallback - see that file's circuit breaker) reports a genuine new
+// message. Electron's own Notification API is the desktop shell's
+// notification path - it sits alongside, not in place of, the browser/PWA's
+// service-worker push path (public/sw.js's `push`/`notificationclick`
+// handlers + lib/web-push.ts).
 ipcMain.handle(
   "vnc:show-notification",
   (_event, title: string, options?: { body?: string; tag?: string }) => {
+    // Test-only observability hook, read via Playwright's
+    // electronApp.evaluate(({ app }) => ...) - see
+    // integration/tests/11-electron-notification.spec.ts. Not gated behind
+    // NODE_ENV: it's an inert counter with no behavioral effect, cheaper
+    // than maintaining a second code path just for tests.
+    const counters = app as unknown as { __notificationCallCount?: number };
+    counters.__notificationCallCount = (counters.__notificationCallCount ?? 0) + 1;
+
     if (!Notification.isSupported()) {
       return { shown: false };
     }