feat: make email bodies follow the active theme

[salmonumbrella]

Summary

Fixes #228.

HTML email bodies now follow MailFlow's effective theme by default, including built-in themes and custom CSS overrides. The renderer lets the browser resolve sender CSS, then performs a bounded, transactional repair of computed colors; if adaptation cannot complete safely, it reveals the existing readable forced-light rendering instead. Users can choose original colors globally or for the current message.

Changes

• Persist an allow-listed email-body appearance preference and expose it in Appearance settings, with translated labels and a per-message override.
• Preserve safe sender dark-mode CSS while continuing to remove active and network-capable content; the iframe remains scriptless and sandboxed.
• Resolve a validated palette from effective app CSS, select sender light/dark media rules, repair only provable color pairs, and protect images, gradients, and other unknown visual islands.
• Use the same bounded controller for iframe and scoped-div renderers, with immutable sanitized input, generation-safe cancellation, rollback, forced-light fallback, print isolation, and strict node/CSS/time budgets.
• Keep the appearance engine lazy-loaded and enforce production bundle budgets in CI; add unit, cross-browser, resource-isolation, and visual regression coverage.

Testing

• Backend tests on Node 22: 1,058 passed across 50 files
• Backend lint: npm run lint
• Frontend tests on Node 22: 1,733 passed across 83 suites
• Frontend lint: npm run lint
• Frontend production build: npm run build
• Bundle gates: npm run test:bundle (appearance chunk 7,182 gzip bytes; eager safety chunk 445 gzip bytes)
• Playwright across Chromium, Firefox, and WebKit: 756 passed
• Pinned Playwright Linux visual matrix: 48 passed
• git diff --check

---

Contributor License Agreement

By submitting this pull request I confirm that:

• I have read and agree to the Contributor License Agreement.
• My contribution is my own original work (or I have identified any
  third-party material and confirmed it is compatible with the CLA).
• I have the right to submit this contribution under the terms of the CLA.

[maathimself]

Going to pass on this implementation, but I'm keeping the dark mode request (#228) open. Appreciate the work.