feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

- Contact groups/lists, vCard import/export (RFC 6350), bulk operations
- Advanced search with JMAP filter panel, search chips, cross-mailbox queries
- Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator
- TOTP two-factor authentication support
- Docker multi-stage build with standalone output and docker-compose
- CSP Report-Only headers and security headers via proxy middleware
- Virtual scrolling for large email lists
- Structured server-side logger (text/JSON, configurable level)
- 450+ tests (contacts, vCard, threads, headers, identity, components)
- Playwright E2E framework setup
- Updated README and ROADMAP with all new features

e2e/contacts.spec.ts

@@ -0,0 +1,17 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Contacts', () => {
+  test.skip('navigates to contacts page', async ({ page }) => {
+    await page.goto('/en/contacts');
+    await expect(page.locator('text=title')).toBeVisible();
+  });
+
+  test.skip('creates a new contact', async ({ page }) => {
+    await page.goto('/en/contacts');
+    await page.click('text=create_new');
+    await page.fill('input[placeholder="given_name"]', 'Test');
+    await page.fill('input[placeholder="surname"]', 'User');
+    await page.fill('input[type="email"]', 'test@example.com');
+    await page.click('button[type="submit"]');
+  });
+});

e2e/email.spec.ts

@@ -0,0 +1,21 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Email', () => {
+  test.skip('loads inbox', async ({ page }) => {
+    await page.goto('/en');
+    await expect(page.locator('[data-testid="email-list"]')).toBeVisible({ timeout: 15000 });
+  });
+
+  test.skip('opens email from list', async ({ page }) => {
+    await page.goto('/en');
+    const firstEmail = page.locator('[data-testid="email-list-item"]').first();
+    await firstEmail.click();
+    await expect(page.locator('[data-testid="email-viewer"]')).toBeVisible();
+  });
+
+  test.skip('composes new email', async ({ page }) => {
+    await page.goto('/en');
+    await page.keyboard.press('c');
+    await expect(page.locator('[data-testid="email-composer"]')).toBeVisible();
+  });
+});

e2e/login.spec.ts

@@ -0,0 +1,25 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Login', () => {
+  test('loads login page', async ({ page }) => {
+    await page.goto('/');
+    await expect(page.locator('input[type="text"]')).toBeVisible();
+    await expect(page.locator('input[type="password"]')).toBeVisible();
+  });
+
+  test('shows error on invalid credentials', async ({ page }) => {
+    await page.goto('/');
+    await page.fill('input[type="text"]', 'invalid@test.com');
+    await page.fill('input[type="password"]', 'wrongpassword');
+    await page.click('button[type="submit"]');
+    await expect(page.locator('[role="alert"], .text-red-600, .text-destructive')).toBeVisible({ timeout: 10000 });
+  });
+
+  test.skip('logs in with valid credentials', async ({ page }) => {
+    await page.goto('/');
+    await page.fill('input[type="text"]', process.env.TEST_USER || '');
+    await page.fill('input[type="password"]', process.env.TEST_PASS || '');
+    await page.click('button[type="submit"]');
+    await expect(page).toHaveURL(/\/en/, { timeout: 15000 });
+  });
+});