feat: add contacts phase 2, advanced search, vacation responder, Docker & TOTP 2FA

- Contact groups/lists, vCard import/export (RFC 6350), bulk operations
- Advanced search with JMAP filter panel, search chips, cross-mailbox queries
- Vacation responder with JMAP VacationResponse, settings tab, sidebar indicator
- TOTP two-factor authentication support
- Docker multi-stage build with standalone output and docker-compose
- CSP Report-Only headers and security headers via proxy middleware
- Virtual scrolling for large email lists
- Structured server-side logger (text/JSON, configurable level)
- 450+ tests (contacts, vCard, threads, headers, identity, components)
- Playwright E2E framework setup
- Updated README and ROADMAP with all new features

proxy.ts

@@ -1,9 +1,61 @@
-import createIntlMiddleware from 'next-intl/middleware';
-import { routing } from './i18n/routing';
+import { type NextRequest, NextResponse } from "next/server";
+import createIntlMiddleware from "next-intl/middleware";
+import { routing } from "./i18n/routing";
 
-export default createIntlMiddleware(routing);
+const intlMiddleware = createIntlMiddleware(routing);
+
+export function proxy(request: NextRequest) {
+  const nonce = crypto.randomUUID();
+  const isDev = process.env.NODE_ENV === "development";
+
+  const scriptSrc = isDev
+    ? `'self' 'nonce-${nonce}' 'unsafe-eval'`
+    : `'self' 'nonce-${nonce}'`;
+
+  const connectSrc = isDev ? `'self' https: ws: wss:` : `'self' https:`;
+
+  const csp = [
+    `default-src 'self'`,
+    `script-src ${scriptSrc}`,
+    `style-src 'self' 'unsafe-inline'`,
+    `img-src 'self' data: https:`,
+    `font-src 'self'`,
+    `connect-src ${connectSrc}`,
+    `frame-src 'none'`,
+    `object-src 'none'`,
+    `base-uri 'self'`,
+    `form-action 'self'`,
+    `frame-ancestors 'none'`,
+  ].join("; ");
+
+  let intlResponse: ReturnType<typeof intlMiddleware> | null = null;
+  try {
+    intlResponse = intlMiddleware(request);
+  } catch (error) {
+    console.error('Locale middleware error:', error);
+  }
+  const response = intlResponse ?? NextResponse.next();
+
+  const existing = response.headers.get("x-middleware-override-headers");
+  response.headers.set(
+    "x-middleware-override-headers",
+    existing ? `${existing},x-nonce` : "x-nonce"
+  );
+  response.headers.set("x-middleware-request-x-nonce", nonce);
+
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  response.headers.set("X-Frame-Options", "DENY");
+  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  response.headers.set("X-XSS-Protection", "0");
+  response.headers.set(
+    "Permissions-Policy",
+    "camera=(), microphone=(), geolocation=(), payment=()"
+  );
+  response.headers.set("Content-Security-Policy-Report-Only", csp);
+
+  return response;
+}
 
 export const config = {
-  // Skip all paths that should not be internationalized
-  matcher: ['/((?!api|_next|.*\\..*).*)']
-};
+  matcher: ["/((?!api|_next|.*\\..*).*)"],
+};