feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

- Contact groups/lists, vCard import/export (RFC 6350), bulk operations
- Advanced search with JMAP filter panel, search chips, cross-mailbox queries
- Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator
- TOTP two-factor authentication support
- Docker multi-stage build with standalone output and docker-compose
- CSP Report-Only headers and security headers via proxy middleware
- Virtual scrolling for large email lists
- Structured server-side logger (text/JSON, configurable level)
- 450+ tests (contacts, vCard, threads, headers, identity, components)
- Playwright E2E framework setup
- Updated README and ROADMAP with all new features

README.md

@@ -25,7 +25,8 @@ This webmail client is designed to work seamlessly with [**Stalwart Mail Server*
 - Mark as read/unread, star/unstar
 - Archive and delete with configurable behavior
 - Color tags/labels for email organization
-- Full-text search
+- Advanced search with JMAP filter panel, search chips, and cross-mailbox queries
+- Virtual scrolling for large email lists
 
 ### User Interface
 - Clean, minimalist three-pane layout
@@ -52,6 +53,14 @@ This webmail client is designed to work seamlessly with [**Stalwart Mail Server*
 - Contact management with search and filtering
 - JMAP server sync (RFC 9553/9610) with local fallback
 - Email autocomplete from contacts in composer
+- Contact groups/lists with group expansion in composer
+- vCard import/export (RFC 6350) with duplicate detection
+- Bulk operations (multi-select, delete, group add, export)
+
+### Vacation Responder
+- JMAP VacationResponse management with date range scheduling
+- Dedicated settings tab with message configuration
+- Sidebar indicator when vacation auto-reply is active
 
 ### Security & Privacy
 - External content blocked by default
@@ -59,14 +68,22 @@ This webmail client is designed to work seamlessly with [**Stalwart Mail Server*
 - HTML sanitization with DOMPurify
 - SPF/DKIM/DMARC status indicators
 - No password storage (session-based auth)
+- TOTP two-factor authentication support
 - Shared folder support with proper permissions
 - Newsletter unsubscribe support (RFC 2369)
+- CSP headers and security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy)
 
 ### Internationalization
 - 8 language support: English, French, Japanese, Spanish, Italian, German, Dutch, Portuguese
 - Automatic browser language detection
 - Persistent language preference
 
+### Deployment
+- Docker support with multi-stage build and standalone output
+- Runtime environment variables (no rebuild needed for config changes)
+- Health check endpoint for container orchestration
+- Structured server-side logging (text/JSON format)
+
 ## Tech Stack
 
 - **Framework**: [Next.js 16](https://nextjs.org/) with App Router
@@ -135,6 +152,19 @@ npm run build
 npm start
 ```
 
+### Docker
+
+```bash
+# Using docker-compose
+cp .env.example .env.local
+# Edit .env.local with your JMAP_SERVER_URL
+docker compose up -d
+
+# Or build manually
+docker build -t jmap-webmail .
+docker run -p 3000:3000 -e JMAP_SERVER_URL=https://mail.example.com jmap-webmail
+```
+
 ## Keyboard Shortcuts
 
 | Key | Action |