fix: prevent browser auth dialog when viewing emails with inline images

Inline CID images were replaced with raw JMAP download URLs that require authentication. When the browser loaded these as <img src>, the server responded with WWW-Authenticate: Basic, triggering a native login popup.

- Add fetchBlobAsObjectUrl() to JMAPClient that fetches blobs via authenticated request and returns blob: object URLs
- Update email-viewer and thread-conversation-view to fetch CID images asynchronously with auth, using blob: URLs instead of raw server URLs
- Add ALLOWED_URI_REGEXP to DOMPurify config so blob: URLs are not stripped during sanitization
- Add tests for fetchBlobAsObjectUrl and CID/blob URL sanitization

lib/jmap/client.ts

@@ -1429,6 +1429,16 @@ export class JMAPClient {
       .replace('{type}', encodeURIComponent(type || 'application/octet-stream'));
   }
 
+  async fetchBlobAsObjectUrl(blobId: string, name?: string, type?: string): Promise<string> {
+    const url = this.getBlobDownloadUrl(blobId, name, type);
+    const response = await this.authenticatedFetch(url, {});
+    if (!response.ok) {
+      throw new Error(`Failed to fetch blob: ${response.status}`);
+    }
+    const blob = await response.blob();
+    return URL.createObjectURL(blob);
+  }
+
   getCapabilities(): Record<string, unknown> {
     return this.capabilities;
   }