fix: harden security across HTTP capabilities, SSRF, crypto, and SQL

[atani]

Hi there!

First off — Velo is an incredibly well-built email client. The architecture is clean, the Tauri integration is solid, and the codebase is remarkably consistent across 130+ test files. Really impressive work.

I ran a security audit while evaluating Velo for personal use and found a few areas where the already-strong security posture could be tightened further. This PR addresses the findings with minimal, focused changes.

Summary

7 targeted security hardening fixes across the frontend and Rust backend:

• HTTP capability restriction — Plain HTTP now limited to localhost AI servers (Ollama/LM Studio). HTTPS remains unrestricted for unsubscribe URLs and external APIs
• SSRF prevention on unsubscribe — New isSafeUrl() guard blocks requests to loopback, private IPv4/IPv6 ranges (including ::ffff: mapped addresses and cloud metadata 169.254.x.x), with redirect following disabled
• SQL injection fix — Parameterized the accountId in compactQueue() (the only place in the codebase that used string interpolation — everything else was already properly parameterized)
• Decryption hardening — decryptField() now throws on failure instead of silently falling back to raw values, preventing potential credential tampering. getAllAccounts() uses Promise.allSettled so one corrupted account doesn't block the rest
• OAuth token_url whitelist — Rust backend validates token exchange URLs against known providers, with prefix matching for Microsoft tenant GUIDs
• Phishing detection improvement — getRegistrableDomain() now handles 38 multi-part ccTLDs (.co.uk, .co.jp, .com.au, etc.) to reduce false positives/negatives in brand impersonation detection

Test plan

• TypeScript type check passes
• Rust cargo check passes
• All 1583 tests pass (134 test files)
• 19 new tests for isSafeUrl() — IPv4/IPv6 private ranges, loopback, schemes, mapped addresses
• 4 new tests for ccTLD brand impersonation (.co.uk, .co.jp, .com.au)
• Manual: one-click unsubscribe still works with real newsletters
• Manual: OAuth login flows (Gmail, Outlook)
• Manual: thread pop-out window actions (reply, archive, star)