fix: Phase 1 critical+high fixes (17/18 items)

CRITICAL fixes:
- C1: Error swallowing - throw TransportError on network failure in getEmails/searchEmails
- C2: Recurrence expansion ID delimiter changed from ':' to '::occurrence::'
- C3: Cross-account calendar event UID dedup after multi-account aggregation
- C4: Admin session token revocation via JTI blacklist on logout
- C6: FTS5 schema-drop - add warning log for automatic reindex trigger
- C7: Settings lock - gate updateSetting() with isSettingLocked() check
- C8: Offline push pause - add offline event handler that closes push transports

HIGH fixes:
- H1: Push handler - add ContactCard and FileNode branches
- H2: WS fallback - await state snapshot before reconcileAfterWebSocketFallback
- H3: Auth rate limiting - add checkUserAuthRateLimit to session and token routes
- H4: OAuth logs - strip access_token from error log context
- H7: Template XSS - apply DOMPurify to HTML template body on import
- H8: Secure cookie - derive from x-forwarded-proto, not NODE_ENV
- H9: bcrypt fix - remove bcrypt prefixes from isHashed() so scrypt-only
- H13: calendarTasksEnabled - apply admin gate at runtime in calendar page
- H14: Task mutations - add try/catch error handling to update/delete/toggle
- H18: autoSelectReplyIdentity default changed from false to true

Deferred: P1.3 (C5 auth localStorage encryption) - requires custom Zustand persist adapter.

lib/admin/session.ts

@@ -11,6 +11,13 @@ const TAG_LENGTH = 16;
 
 const MIN_SECRET_LENGTH = 32;
 
+const revokedTokens = new Map<string, number>(); // jti → expiry timestamp
+
+function isHttpsRequest(req: { headers: Headers }): boolean {
+  const proto = req.headers.get('x-forwarded-proto');
+  return proto === 'https';
+}
+
 function getKey(): Buffer {
   const secret = getSessionSecret();
   if (!secret) throw new Error('SESSION_SECRET not configured');
@@ -37,10 +44,12 @@ export function createAdminSession(): string {
   const cipher = createCipheriv(ALGORITHM, key, iv);
 
   const now = Math.floor(Date.now() / 1000);
+  const exp = now + getSessionTTL();
   const payload: AdminSessionPayload = {
     role: 'admin',
     iat: now,
-    exp: now + getSessionTTL(),
+    exp,
+    jti: randomBytes(16).toString('hex'),
   };
 
   const json = JSON.stringify(payload);
@@ -74,12 +83,29 @@ export function verifyAdminSession(token: string): AdminSessionPayload | null {
     const now = Math.floor(Date.now() / 1000);
     if (payload.exp < now) return null;
 
+    // Clean up expired revocations while we're here
+    for (const [jti, expiry] of revokedTokens) {
+      if (expiry < now) revokedTokens.delete(jti);
+    }
+
+    if (payload.jti && revokedTokens.has(payload.jti)) return null;
+
     return payload;
   } catch {
     return null;
   }
 }
 
+/**
+ * Revoke an admin session token so it cannot be used again.
+ */
+export function revokeAdminSession(token: string): void {
+  const payload = verifyAdminSession(token);
+  if (payload?.jti) {
+    revokedTokens.set(payload.jti, payload.exp);
+  }
+}
+
 /**
  * CSRF gate for cookie-authed admin requests.
  *
@@ -146,12 +172,12 @@ export async function requireAdminAuth(request: Request): Promise<{ payload: Adm
 /**
  * Set the admin session cookie.
  */
-export async function setAdminSessionCookie(): Promise<void> {
+export async function setAdminSessionCookie(request?: { headers: Headers }): Promise<void> {
   const token = createAdminSession();
   const cookieStore = await cookies();
   cookieStore.set(ADMIN_SESSION_COOKIE, token, {
     httpOnly: true,
-    secure: process.env.NODE_ENV === 'production',
+    secure: request ? isHttpsRequest(request) : process.env.NODE_ENV === 'production',
     sameSite: 'lax',
     path: '/',
     maxAge: getSessionTTL(),