fix: Phase 1 critical+high fixes (17/18 items)

CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports

HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true

Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.

stores/calendar-store.ts

@@ -387,7 +387,16 @@ export const useCalendarStore = create<CalendarStore>()(
               }
             }),
           );
-          set({ events: results.flat(), isLoadingEvents: false, dateRange: { start, end } });
+          const allEvents = results.flat();
+          // Deduplicate cross-account events by uid + recurrenceId
+          const seen = new Set<string>();
+          const deduped = allEvents.filter(e => {
+            const key = `${e.uid || e.id}::${e.recurrenceId || ''}`;
+            if (seen.has(key)) return false;
+            seen.add(key);
+            return true;
+          });
+          set({ events: deduped, isLoadingEvents: false, dateRange: { start, end } });
         } catch (error) {
           debug.error('Failed to fetch all-account events:', error);
           set({ error: 'Failed to load events', isLoadingEvents: false });

stores/email-store.ts

@@ -2940,6 +2940,25 @@ export const useEmailStore = create<EmailStore>((set, get) => ({
         }
       }
 
+      // Handle ContactCard state changes - refresh contacts
+      if (accountChanges?.ContactCard) {
+        const { useContactStore } = await import('./contact-store');
+        const contactStore = useContactStore.getState();
+        contactStore.fetchContacts(client).catch((err) => {
+          console.error('Failed to refresh contacts on push:', err);
+        });
+      }
+
+      // Handle FileNode state changes - refresh current directory
+      if (accountChanges?.FileNode) {
+        const { useFileStore } = await import('./file-store');
+        const fileStore = useFileStore.getState();
+        const currentParentId = fileStore.currentParentId;
+        fileStore.navigate(currentParentId).catch((err) => {
+          console.error('Failed to refresh files on push:', err);
+        });
+      }
+
       // Local search index last, with the refreshed ids (see above).
       scheduleIndexUpdate();
     } catch (error) {

stores/settings-store.ts

@@ -484,7 +484,7 @@ const DEFAULT_SETTINGS = {
   autoSaveDraftInterval: 60000, // 1 minute
   sendConfirmation: false,
   defaultReplyMode: 'reply' as ReplyMode,
-  autoSelectReplyIdentity: false,
+  autoSelectReplyIdentity: true,
   plainTextMode: false,
   rtlEditingSupport: false,
   subAddressDelimiter: DEFAULT_SUB_ADDRESS_DELIMITER,
@@ -643,7 +643,14 @@ export const useSettingsStore = create<SettingsState>()(
     (set, get) => ({
       ...DEFAULT_SETTINGS,
 
-      updateSetting: (key, value) => {
+      updateSetting: (key, value, opts?: { force?: boolean }) => {
+        if (!opts?.force) {
+          try {
+            const { usePolicyStore } = require('./policy-store');
+            const locked = usePolicyStore.getState().isSettingLocked(key);
+            if (locked) return;
+          } catch { /* policy store may not be loaded yet */ }
+        }
         set({ [key]: value });
 
         // Apply font size to document root

stores/task-store.ts

@@ -65,30 +65,45 @@ export const useTaskStore = create<TaskStore>((set, get) => ({
   },
 
   updateTask: async (client, id, updates) => {
-    await client.updateCalendarTask(id, updates);
-    set({
-      tasks: get().tasks.map(t => t.id === id ? { ...t, ...updates, updated: new Date().toISOString() } : t),
-    });
+    try {
+      await client.updateCalendarTask(id, updates);
+      set({
+        tasks: get().tasks.map(t => t.id === id ? { ...t, ...updates, updated: new Date().toISOString() } : t),
+      });
+    } catch (error) {
+      debug.error('TaskStore/updateTask failed', error);
+      set({ error: 'Failed to update task' });
+    }
   },
 
   deleteTask: async (client, id) => {
-    await client.deleteCalendarTask(id);
-    set({
-      tasks: get().tasks.filter(t => t.id !== id),
-      selectedTaskId: get().selectedTaskId === id ? null : get().selectedTaskId,
-    });
+    try {
+      await client.deleteCalendarTask(id);
+      set({
+        tasks: get().tasks.filter(t => t.id !== id),
+        selectedTaskId: get().selectedTaskId === id ? null : get().selectedTaskId,
+      });
+    } catch (error) {
+      debug.error('TaskStore/deleteTask failed', error);
+      set({ error: 'Failed to delete task' });
+    }
   },
 
   toggleTaskComplete: async (client, task) => {
-    const newProgress = task.progress === 'completed' ? 'needs-action' : 'completed';
-    const updates: Partial<CalendarTask> = {
-      progress: newProgress,
-      progressUpdated: new Date().toISOString(),
-    };
-    await client.updateCalendarTask(task.id, updates);
-    set({
-      tasks: get().tasks.map(t => t.id === task.id ? { ...t, ...updates, updated: new Date().toISOString() } : t),
-    });
+    try {
+      const newProgress = task.progress === 'completed' ? 'needs-action' : 'completed';
+      const updates: Partial<CalendarTask> = {
+        progress: newProgress,
+        progressUpdated: new Date().toISOString(),
+      };
+      await client.updateCalendarTask(task.id, updates);
+      set({
+        tasks: get().tasks.map(t => t.id === task.id ? { ...t, ...updates, updated: new Date().toISOString() } : t),
+      });
+    } catch (error) {
+      debug.error('TaskStore/toggleTaskComplete failed', error);
+      set({ error: 'Failed to update task' });
+    }
   },
 
   clearTasks: () => set({ tasks: [], selectedTaskId: null, error: null }),