feat: add plugin ui.rerenderEmail API and restyle read-receipt banner

lib/plugin-sandbox/host-api.ts

@@ -56,6 +56,7 @@ const PERM_PER_METHOD: Record<string, Permission | null> = {
   'ui.confirm': null,
   'ui.alert': null,
   'ui.prompt': null,
+  'ui.rerenderEmail': null,
   'ui.openExternalUrl': null,
 };
 
@@ -410,6 +411,14 @@ export async function dispatchApiCall(
         fields,
       });
     }
+    case 'ui.rerenderEmail': {
+      // Re-run the onRenderEmailBody hook for the currently open message. Used
+      // by crypto plugins after they change decryption state (e.g. an S/MIME key
+      // was just unlocked) so the body re-decrypts without a full reload — which
+      // would wipe the in-memory session keys.
+      window.dispatchEvent(new CustomEvent('plugin:rerender-email'));
+      return undefined;
+    }
     case 'ui.openExternalUrl': {
       const url = String(args[0] ?? '');
       // Only http(s) - the sandbox should not be able to navigate the host