fix: Phase 1 critical+high fixes (17/18 items)

CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports

HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true

Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.

lib/jmap/client.ts

@@ -3,10 +3,21 @@ import type { SieveScript, SieveCapabilities } from "./sieve-types";
 import type { IJMAPClient } from "./client-interface";
 import { toWildcardQuery } from "./search-utils";
 import { batched, itemsPerRequest } from "./request-limits";
-import { noteTransportFailure, noteTransportSuccess } from "./transport-health";
+import { noteTransportFailure, noteTransportSuccess, transportFailureCount } from "./transport-health";
 import { debug } from "@/lib/debug";
 import { normalizeCalendarEventLike } from "@/lib/calendar-event-normalization";
 
+export class TransportError extends Error {
+  constructor(message = 'Network transport failure') {
+    super(message);
+    this.name = 'TransportError';
+  }
+}
+
+function wasTransportFailure(beforeCount: number): boolean {
+  return transportFailureCount() > beforeCount;
+}
+
 /** Parse a recipient string that may be "Name <email>" or bare "email" into { name?, email }. */
 function parseRecipientString(s: string): { name?: string; email: string } {
   const trimmed = s.trim();
@@ -1220,6 +1231,7 @@ export class JMAPClient implements IJMAPClient {
   }
 
   async getEmails(mailboxId?: string, accountId?: string, limit: number = 50, position: number = 0, hasKeyword?: string, pinnedFirst?: boolean, extraFilter?: Record<string, unknown>): Promise<{ emails: Email[], hasMore: boolean, total: number }> {
+    const tcBefore = transportFailureCount();
     try {
       const targetAccountId = accountId || this.accountId;
       const simple: { inMailbox?: string; hasKeyword?: string } = {};
@@ -1290,6 +1302,9 @@ export class JMAPClient implements IJMAPClient {
 
       return { emails: [], hasMore: false, total: 0 };
     } catch (error) {
+      if (wasTransportFailure(tcBefore)) {
+        throw new TransportError('Failed to get emails: network transport failure');
+      }
       console.error('Failed to get emails:', error);
       return { emails: [], hasMore: false, total: 0 };
     }
@@ -2099,6 +2114,7 @@ export class JMAPClient implements IJMAPClient {
   }
 
   async searchEmails(query: string, mailboxId?: string, accountId?: string, limit: number = 50, position: number = 0): Promise<{ emails: Email[], hasMore: boolean, total: number }> {
+    const tcBefore = transportFailureCount();
     try {
       const targetAccountId = accountId || this.accountId;
 
@@ -2154,6 +2170,9 @@ export class JMAPClient implements IJMAPClient {
 
       return { emails, hasMore, total };
     } catch (error) {
+      if (wasTransportFailure(tcBefore)) {
+        throw new TransportError('Search failed: network transport failure');
+      }
       console.error('Search failed:', error);
       return { emails: [], hasMore: false, total: 0 };
     }
@@ -6041,6 +6060,7 @@ export class JMAPClient implements IJMAPClient {
   private lastSSEActivity: number = 0;
   private visibilityHandler: (() => void) | null = null;
   private onlineHandler: (() => void) | null = null;
+  private offlineHandler: (() => void) | null = null;
 
   // JMAP-over-WebSocket (RFC 8887) push - preferred over SSE when the server
   // advertises it (getWebSocketUrl()), since it's the transport the desktop
@@ -6301,6 +6321,7 @@ export class JMAPClient implements IJMAPClient {
    * original 31s-worst-case ladder did.
    */
   private async reconcileAfterWebSocketFallback(): Promise<void> {
+    await this._stateSnapshotPromise;
     await this.checkForStateChanges();
 
     const eventSourceUrl = this.getEventSourceUrl();
@@ -6781,6 +6802,11 @@ export class JMAPClient implements IJMAPClient {
     }
 
     if (typeof window !== 'undefined') {
+      this.offlineHandler = () => {
+        this.closePushNotifications();
+      };
+      window.addEventListener('offline', this.offlineHandler);
+
       this.onlineHandler = () => {
         // Network reconnected - reconnect WS/SSE or force a poll. Don't
         // make the user wait through whatever backoff delay was already in
@@ -6814,6 +6840,10 @@ export class JMAPClient implements IJMAPClient {
       document.removeEventListener('visibilitychange', this.visibilityHandler);
       this.visibilityHandler = null;
     }
+    if (this.offlineHandler && typeof window !== 'undefined') {
+      window.removeEventListener('offline', this.offlineHandler);
+      this.offlineHandler = null;
+    }
     if (this.onlineHandler && typeof window !== 'undefined') {
       window.removeEventListener('online', this.onlineHandler);
       this.onlineHandler = null;