feat: Phase 3+4 — security hardening + polish + offline + Electron push

Phase 3 (security):
- P3.1: Feature gate server-side enforcement (403 on disabled features)
- P3.2: Unified auth error interceptor (401→logout)
- P3.3: Store-level state isolation via StoreSnapshot contract
  (added message-list-tabs + task stores to snapshot/restore cycle)
- P3.4: Push event bus extraction — email-store no longer imports
  calendar/contact/filter/file stores directly
- P1.3: Auth localStorage AES-GCM encryption via custom Zustand adapter

Phase 4 (polish):
- P4.1: Offline write queue — pending operations in localStorage,
  auto-retry on reconnect, offline-queue-indicator banner
- P4.2: Identity spoofing — fromOverrideEmail domain validation
- P4.3: WebSocket push for Electron via main-process IPC bridge
  (ws package with Authorization headers)

scripts/build-electron.mjs

@@ -19,7 +19,7 @@ const shared = {
   // stays external so electron-builder ships it from node_modules as a
   // normal production dependency instead of us re-bundling its native-ish
   // internals (see electron-builder.config.js's file collection).
-  external: ["electron", "electron-updater"],
+  external: ["electron", "electron-updater", "ws"],
   logLevel: "info",
 };