v0.2.3 — five silent failures, and attachments that stay inside the identity

Four bugs found by using GigaMail for a real morning of mail, not by
reading the code. Three of them shared a shape: the action reported
success and did the wrong thing quietly.

• Approval toasts came out mute. Every MCP tool creates its request
  through require_approval(), which notified without passing actions
  — so the toast was built with no buttons and the human saw an alert
  with nothing to press. Only the watcher's semi-auto path passed them,
  which is why the feature looked like it worked. Now every approval
  carries the same four: Leggi / Approva / Modifica / Rifiuta. Leggi
  shows the entire preview (no more 300-character truncation of a mail
  body) and lets you decide on the spot — reading and deciding are the
  same moment. Modifica rejects the request and hands back your note.
  Buttons still only open a gigamail:// URL: Approva goes through
  Windows Hello exactly as before.

• A second Python on the machine silenced the buttons.
  protocol_registered() compared the HKLM registration with
  sys.executable, so the system Python next to the venv one produced a
  mute toast without a word. What matters is the registered command,
  not who is reading it.

• Multi-recipient sends put one malformed address in the envelope.
  send_mail("a@x.it, b@y.it") passed the string whole: SMTP issued a
  single RCPT TO:<a@x.it, b@y.it>, Graph a single toRecipients. The
  provider need not refuse it — ours didn't, returning success: true
  and "accepted": 1. Half the recipients were never in the envelope and
  nothing said so; the To: header was right, so the copy in Sent looked
  fine. split_addresses() (new core/addresses.py) is now used by
  SMTP, by Graph and by the preview you approve, so the list you
  approve and the envelope that leaves cannot drift apart.

• send_mail and reply_mail can attach identity files. Only files
  registered in that account's identity (price lists, floor plans),
  never an arbitrary path — otherwise send_mail is the easiest way to
  walk a file off the disk, and approval doesn't help, because the human
  approves a name. The preview lists name, path and real size of every
  attachment; a name that resolves to nothing aborts the request rather
  than sending a mail without the plan its body promises.

• Dotted names resolved to the wrong file.
  os.path.splitext("B.1.3") returns ("B.1", ".3"), so a lookup for
  apartment B.1.3 searched for "B.1" and matched B.1.1, B.1.2, B.1.4 as
  well — first one wins. Silent: the mail went out carrying another
  apartment's floor plan. read_knowledge_file shares that function, so
  asking for one data sheet could return another. Fixed, and an
  ambiguous name now stops the request instead of guessing.

• Toasts stayed put and stopped swallowing each other. Five approvals
  raised in a row appeared as one: Windows collapses toasts from the same
  app unless each carries its own tag, so four vanished silently at the
  exact moment there were five decisions to make. The tag is now the
  request_id — and re-raising the same request replaces its toast
  instead of stacking a duplicate. The popup also no longer expires under
  you mid-read (scenario='reminder': it stays until you decide; Windows
  offers no arbitrary duration, duration='long' tops out near 25s).
  The 15 minutes now live where they are real: the notification is born
  with the request's own TTL, so it sits in the action centre exactly as
  long as the approval is valid and removes itself when it dies — no
  Approva button on a request that can no longer be approved.

• 中文: the README has a full Chinese section and the console speaks
  Chinese (language switch cycles IT → EN → 中; first-pass translation of
  all ~270 strings, with English fallback for anything missed — polish
  and corrections are very welcome: console/i18n.js).

• Changing the Telegram chat revokes trust (u/Secondmindsystems,
  r/mcp, within hours of the 0.2.1 post): the chat allowed to approve is
  the one recorded behind Windows Hello / Touch ID at gigamail telegram setup --approve, stored outside notify.json. If the configured
  chat_id stops matching it, the watcher disables Telegram approval,
  rejects every pending rule request (decided_by: system:telegram-chat-changed), alerts the previously trusted chat once,
  and audits the mismatch; approval returns only through the verified
  setup. His second point — an edited draft must invalidate the old
  approval — was already the behaviour (✏️ rejects the old request and
  creates a new request_id; approval binds to the canonical payload), now
  stated explicitly. Note: existing installs must re-run
  gigamail telegram setup --approve once to record the trusted chat.