security(smime): fix finding 5 (parser DoS) and harden finding 4

Finding 5 — the MIME parser runs on attacker-controlled input: the inner
content recovered after decrypt/verify is whatever the sender put there.
Upstream had no depth limit on nested multiparts and no size cap anywhere.

Verified against the unpatched upstream parser with the same input:

  UPSTREAM CRASHED: RangeError - Maximum call stack size exceeded
  UPSTREAM: 65MB accepted (no size cap)

So this was a live decrypt-time DoS reachable by anyone who can send mail.

Caps added: depth 20, parts 500, bytes 64 MB — generous enough that no
legitimate message comes close (real mail nests 3-4 levels). Past a limit a
subtree degrades to a leaf rather than throwing, so one pathological branch
doesn't discard the legitimate parts above it. Oversize input is refused
outright rather than truncated: half a MIME tree parses into misleading
nonsense, and showing part of a message is worse than saying no. Both
bodyStructure walkers in smime-detect.js are capped too — those run on
server-supplied structure BEFORE any decrypt/verify gate.

Finding 4 — hardened, not eliminated, per the agreed scope. Unlocked
CryptoKeys still live in durable IndexedDB rather than memory; moving them
would mean refactoring how the plugin shares state across iframes and
risking the unlock->decrypt path just verified.

What changed instead:

- Removed the lockOnLogout opt-out from the logout/account-switch wipes. A
  non-extractable key cannot be exported but can still be USED, so a handle
  outliving the session lets anyone with the browser profile decrypt mail
  without knowing the passphrase. That is not a preference to toggle off.
- Added a best-effort wipe on pagehide and beforeunload to narrow the window
  in which a usable handle exists on disk. Best-effort by nature: an
  IndexedDB write may not complete during teardown and neither event fires
  on a crash — which is precisely why the boot wipe in activate() remains
  the load-bearing control.
- Deliberately NOT wiping on visibilitychange: tabbing away would drop the
  unlock and force a passphrase re-entry every time, which trains users into
  turning S/MIME off entirely.
- Dropped the now-dead lockOnLogout setting from the manifest. A toggle that
  silently does nothing is worse than no toggle.

Tests: 49 unit assertions + 28 round trip. The round trip now feeds genuinely
hostile MIME through the real parser (5000-level nesting, 5000 siblings,
65 MB) and still confirms a normal multipart/alternative parses correctly.
Full crypto round trip unchanged and passing, so neither fix broke S/MIME.

Findings 6, 7, 8 and 9 remain open.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

vnc/plugins/smime/src/smime-detect.js

@@ -3,6 +3,11 @@
  * Checks Content-Type, JMAP bodyStructure, and attachment metadata.
  */
 
+// VNC (audit finding 5): cap for the two bodyStructure walkers below. No real
+// message nests anywhere near this; a crafted one could otherwise recurse until
+// the stack gives out, before any decrypt/verify gate has run.
+const MAX_WALK_DEPTH = 20;
+
 export function detectSmime(contentType, bodyStructure, attachments) {
   const noResult = { type: null, supported: false };
 
@@ -66,7 +71,7 @@ export function detectSmime(contentType, bodyStructure, attachments) {
   return noResult;
 }
 
-function walkBodyStructure(part) {
+function walkBodyStructure(part, depth = 0) {
   const type = part.type?.toLowerCase() || '';
 
   if (type.includes('application/pkcs7-mime') || type.includes('application/x-pkcs7-mime')) {
@@ -85,9 +90,12 @@ function walkBodyStructure(part) {
     }
   }
 
-  if (part.subParts) {
+  // VNC (finding 5): bound the walk. bodyStructure comes from the JMAP server,
+  // but a deeply-nested structure — hostile, or just a server that parsed a
+  // crafted message loosely — reaches here BEFORE any decrypt/verify gate.
+  if (part.subParts && depth < MAX_WALK_DEPTH) {
     for (const sub of part.subParts) {
-      const result = walkBodyStructure(sub);
+      const result = walkBodyStructure(sub, depth + 1);
       if (result) return result;
     }
   }
@@ -95,15 +103,15 @@ function walkBodyStructure(part) {
   return null;
 }
 
-function findCmsPart(bodyStructure, _smimeType) {
+function findCmsPart(bodyStructure, _smimeType, depth = 0) {
   if (!bodyStructure) return null;
   const type = bodyStructure.type?.toLowerCase() || '';
   if (type.includes('application/pkcs7-mime') || type.includes('application/x-pkcs7-mime')) {
     return bodyStructure;
   }
-  if (bodyStructure.subParts) {
+  if (bodyStructure.subParts && depth < MAX_WALK_DEPTH) {
     for (const sub of bodyStructure.subParts) {
-      const found = findCmsPart(sub, _smimeType);
+      const found = findCmsPart(sub, _smimeType, depth + 1);
       if (found) return found;
     }
   }