feat(mail-index): 1-year retention by default + a recency retrieval leg

The two things that made real questions fail against a correctly-populated
index, both fixed at the root.

RETENTION (A1). `INDEX_WINDOW_DAYS = 30` was not merely a fetch bound — catch-up
also PRUNED mail older than it, so "summarise everything from July" was
unanswerable in August because the rows had been deleted, while the UI said
only that nothing matched. Now a user-visible setting (Settings → About &
Data): 30 days / 3 months / 1 year / everything, defaulting to 1 YEAR per the
product owner. The window bounds the fetch AND the prune from one value so the
two can never disagree and delete what was just written; "everything" skips
pruning entirely rather than falling back to some default bound. The per-pass
ceiling scales with the window (500/30d, hard cap 20k) because 500 messages is
right for a month and nonsense for "everything". Email/query now omits the
`after` filter entirely when unbounded — Stalwart rejects a malformed filter
rather than treating `undefined` as unset.

RECENCY (A2). Keyword search structurally cannot answer a question about WHEN:
bm25 ranks by term overlap, so "who sent the last email" matches documents
containing the word "last", and "all mails in July" matches documents
containing "July" — not documents dated in July. Both were asked by a real
user and both failed. New lib/mail-index/recency.ts detects time intent
(English + German, since the UI ships German) and turns it into a date RANGE;
new MailIndex.recent() answers it with an ordered scan over the already-indexed
`occurred_at`. The route ADDS these hits to the keyword hits rather than
replacing them — "what did the last mail from Anna say" is both kinds of
question at once.

Timezone subtlety worth knowing: bounds are built from LOCAL calendar
boundaries and serialised as UTC instants, so "July" covers the user's July.
A mail at 00:30 local on 1 July belongs to it even though its stored UTC
timestamp reads 30 June. My first test asserted the ISO string prefix, which
would have enshrined the opposite and passed only in UTC — the tests now
assert the local-time property instead.

SCOPE, stated by the product owner and now enforced structurally: the
assistant only ever sees the mailbox the user is signed in to. Both retrieval
legs resolve the active account (local leg by cookie slot, server leg by the
session's own JMAP account); there is deliberately no fan-out across connected
or shared mailboxes, and adding one would be a policy change, not a feature.

Gate: tsc clean, eslint clean, 2520/2520 tests (8 new for recency intent), build clean.

components/settings/local-index-settings.tsx

@@ -14,7 +14,9 @@ import { Button } from '@/components/ui/button';
 import { SettingsSection, SettingItem } from './settings-section';
 import { isElectronShell } from '@/lib/electron-bridge';
 import { useAccountStore } from '@/stores/account-store';
-import { catchUpIndex, fetchIndexStats, type IndexStats } from '@/lib/mail-index-client';
+import {
+  catchUpIndex, fetchIndexStats, getRetentionDays, setRetentionDays, type IndexStats,
+} from '@/lib/mail-index-client';
 import {
   chainSync, fetchReplicaStatus, purgeReplica, updateRetentionPolicy,
   type ReplicaStatus, type RetentionPolicy,
@@ -35,6 +37,10 @@ export function LocalIndexSettings() {
   // `null` until the first probe resolves, so we don't flash a panel that then
   // vanishes on a non-desktop build.
   const [available, setAvailable] = useState<boolean | null>(null);
+  // `null` = keep everything. Read once on mount; the setter writes through.
+  const [retentionDays, setRetentionDaysState] = useState<number | null>(365);
+
+  useEffect(() => { setRetentionDaysState(getRetentionDays()); }, []);
 
   const refreshStats = useCallback(async () => {
     const next = await fetchIndexStats(slot);
@@ -54,7 +60,7 @@ export function LocalIndexSettings() {
     setBusy(true);
     setMessage(null);
     try {
-      const result = await catchUpIndex(slot);
+      const result = await catchUpIndex(slot, retentionDays);
       if (result.unavailable) {
         setAvailable(false);
         setMessage(result.error ?? 'The encrypted index is unavailable on this system.');
@@ -110,6 +116,32 @@ export function LocalIndexSettings() {
         <span className="text-sm text-muted-foreground tabular-nums">{total}</span>
       </SettingItem>
 
+      <SettingItem
+        label="Keep AI search history for"
+        description={
+          'How far back the AI assistant can search your mail. This also PRUNES: mail older ' +
+          'than the window is removed from the local index on the next update, so a short ' +
+          'window means questions about older mail cannot be answered. Only ever covers the ' +
+          'mailbox you are signed in to.'
+        }
+      >
+        <select
+          className="h-9 rounded-md border border-border bg-background px-2 text-sm"
+          value={retentionDays === null ? 'forever' : String(retentionDays)}
+          onChange={(e) => {
+            const next = e.target.value === 'forever' ? null : Number.parseInt(e.target.value, 10);
+            setRetentionDaysState(next);
+            setRetentionDays(next);
+            setMessage('Saved. Choose "Update index" to apply it now.');
+          }}
+        >
+          <option value="30">30 days</option>
+          <option value="90">3 months</option>
+          <option value="365">1 year</option>
+          <option value="forever">Everything</option>
+        </select>
+      </SettingItem>
+
       <SettingItem
         label="Update now"
         description={