feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

- Contact groups/lists, vCard import/export (RFC 6350), bulk operations
- Advanced search with JMAP filter panel, search chips, cross-mailbox queries
- Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator
- TOTP two-factor authentication support
- Docker multi-stage build with standalone output and docker-compose
- CSP Report-Only headers and security headers via proxy middleware
- Virtual scrolling for large email lists
- Structured server-side logger (text/JSON, configurable level)
- 450+ tests (contacts, vCard, threads, headers, identity, components)
- Playwright E2E framework setup
- Updated README and ROADMAP with all new features

e2e/email.spec.ts

@@ -0,0 +1,21 @@
+import { test, expect } from '@playwright/test';
+
+test.describe('Email', () => {
+  test.skip('loads inbox', async ({ page }) => {
+    await page.goto('/en');
+    await expect(page.locator('[data-testid="email-list"]')).toBeVisible({ timeout: 15000 });
+  });
+
+  test.skip('opens email from list', async ({ page }) => {
+    await page.goto('/en');
+    const firstEmail = page.locator('[data-testid="email-list-item"]').first();
+    await firstEmail.click();
+    await expect(page.locator('[data-testid="email-viewer"]')).toBeVisible();
+  });
+
+  test.skip('composes new email', async ({ page }) => {
+    await page.goto('/en');
+    await page.keyboard.press('c');
+    await expect(page.locator('[data-testid="email-composer"]')).toBeVisible();
+  });
+});