feat(mail-index): 1-year retention by default + a recency retrieval leg

The two things that made real questions fail against a correctly-populated
index, both fixed at the root.

RETENTION (A1). `INDEX_WINDOW_DAYS = 30` was not merely a fetch bound — catch-up
also PRUNED mail older than it, so "summarise everything from July" was
unanswerable in August because the rows had been deleted, while the UI said
only that nothing matched. Now a user-visible setting (Settings → About &
Data): 30 days / 3 months / 1 year / everything, defaulting to 1 YEAR per the
product owner. The window bounds the fetch AND the prune from one value so the
two can never disagree and delete what was just written; "everything" skips
pruning entirely rather than falling back to some default bound. The per-pass
ceiling scales with the window (500/30d, hard cap 20k) because 500 messages is
right for a month and nonsense for "everything". Email/query now omits the
`after` filter entirely when unbounded — Stalwart rejects a malformed filter
rather than treating `undefined` as unset.

RECENCY (A2). Keyword search structurally cannot answer a question about WHEN:
bm25 ranks by term overlap, so "who sent the last email" matches documents
containing the word "last", and "all mails in July" matches documents
containing "July" — not documents dated in July. Both were asked by a real
user and both failed. New lib/mail-index/recency.ts detects time intent
(English + German, since the UI ships German) and turns it into a date RANGE;
new MailIndex.recent() answers it with an ordered scan over the already-indexed
`occurred_at`. The route ADDS these hits to the keyword hits rather than
replacing them — "what did the last mail from Anna say" is both kinds of
question at once.

Timezone subtlety worth knowing: bounds are built from LOCAL calendar
boundaries and serialised as UTC instants, so "July" covers the user's July.
A mail at 00:30 local on 1 July belongs to it even though its stored UTC
timestamp reads 30 June. My first test asserted the ISO string prefix, which
would have enshrined the opposite and passed only in UTC — the tests now
assert the local-time property instead.

SCOPE, stated by the product owner and now enforced structurally: the
assistant only ever sees the mailbox the user is signed in to. Both retrieval
legs resolve the active account (local leg by cookie slot, server leg by the
session's own JMAP account); there is deliberately no fan-out across connected
or shared mailboxes, and adding one would be a policy change, not a feature.

Gate: tsc clean, eslint clean, 2520/2520 tests (8 new for recency intent), build clean.

lib/mail-index-client.ts

@@ -70,6 +70,9 @@ export interface IndexRequestOptions {
   ids?: Partial<Record<IndexContentType, string[]>>;
   /** Backfill the recent window for every supported type, and prune. */
   catchUp?: boolean;
+  /** Retention window in days, or null to keep everything. Omitted = server
+   *  default (1 year). Bounds the fetch AND the prune together. */
+  windowDays?: number | null;
   /** Cookie slot of the account to index. Defaults to the server's first signed-in slot. */
   slot?: number;
 }
@@ -96,6 +99,7 @@ export async function requestIndex(options: IndexRequestOptions = {}): Promise<I
           types: options.types,
           ids: options.ids,
           catchUp: options.catchUp === true,
+          ...(options.windowDays !== undefined ? { windowDays: options.windowDays } : {}),
         }),
       });
 
@@ -169,8 +173,32 @@ export function indexOnStateChange(
  * (`client.ts`'s buildStatePollingRequest polls Mailbox/Email/Calendar/
  * CalendarEvent/SieveScript only).
  */
-export async function catchUpIndex(slot?: number): Promise<IndexRunResult> {
-  return requestIndex({ catchUp: true, slot });
+export async function catchUpIndex(slot?: number, windowDays?: number | null): Promise<IndexRunResult> {
+  return requestIndex({ catchUp: true, slot, windowDays });
+}
+
+// ── Retention setting ────────────────────────────────────────────────────
+// Renderer-owned: the renderer already drives every index run, so keeping the
+// choice here avoids a second source of truth on the server that could drift
+// out of step with what the user last picked.
+
+const RETENTION_KEY = 'vncmail:index:retention-days';
+/** Matches DEFAULT_RETENTION_WINDOW_DAYS in lib/mail-index/reindex.ts. */
+export const DEFAULT_RETENTION_DAYS = 365;
+
+/** `null` = keep everything. */
+export function getRetentionDays(): number | null {
+  if (typeof window === 'undefined') return DEFAULT_RETENTION_DAYS;
+  const raw = window.localStorage.getItem(RETENTION_KEY);
+  if (raw === null) return DEFAULT_RETENTION_DAYS;
+  if (raw === 'forever') return null;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) ? parsed : DEFAULT_RETENTION_DAYS;
+}
+
+export function setRetentionDays(days: number | null): void {
+  if (typeof window === 'undefined') return;
+  window.localStorage.setItem(RETENTION_KEY, days === null ? 'forever' : String(days));
 }
 
 export interface IndexStats {