feat: Phase 3+4 — security hardening + polish + offline + Electron push

Phase 3 (security):
- P3.1: Feature gate server-side enforcement (403 on disabled features)
- P3.2: Unified auth error interceptor (401→logout)
- P3.3: Store-level state isolation via StoreSnapshot contract
  (added message-list-tabs + task stores to snapshot/restore cycle)
- P3.4: Push event bus extraction — email-store no longer imports
  calendar/contact/filter/file stores directly
- P1.3: Auth localStorage AES-GCM encryption via custom Zustand adapter

Phase 4 (polish):
- P4.1: Offline write queue — pending operations in localStorage,
  auto-retry on reconnect, offline-queue-indicator banner
- P4.2: Identity spoofing — fromOverrideEmail domain validation
- P4.3: WebSocket push for Electron via main-process IPC bridge
  (ws package with Authorization headers)

lib/electron-bridge.ts

@@ -7,9 +7,6 @@
 // Web/PWA deployments never get `window.vnc` at all (contextBridge only
 // exists inside the Electron shell), so `isElectronShell()` is false there
 // and callers should keep using the lib/web-push.ts + public/sw.js path.
-// Wiring this bridge up to real mail-delivery events (JMAP WebSocket push
-// vs. polling) is a separate, later decision - this module is only the
-// plumbing.
 
 export interface ShowNotificationOptions {
   body?: string;
@@ -20,12 +17,24 @@ export interface ShowNotificationResult {
   shown: boolean;
 }
 
+export interface WsMessageEvent {
+  id: string;
+  type: "open" | "message" | "close" | "error";
+  data?: string;
+  code?: number;
+  message?: string;
+}
+
 export interface VncElectronBridge {
   isElectron: true;
   showNotification: (
     title: string,
     options?: ShowNotificationOptions,
   ) => Promise<ShowNotificationResult>;
+  wsConnect: (url: string, authHeader: string) => Promise<string>;
+  wsSend: (id: string, data: string) => Promise<boolean>;
+  wsClose: (id: string) => Promise<void>;
+  onWsMessage: (callback: (event: WsMessageEvent) => void) => () => void;
 }
 
 declare global {