v0.10.0

• Move the human review window onto agent-first-ui: afmail's own TcpListener loop, request parser, urlencoded decoder, Chromium launcher, and profile guard are deleted, and the single action= form path becomes typed routes
• Give each review surface its own ui_kind (triage_review, case_review, notification_review, draft_review) so replacing one frontend cannot silently replace the other three
• Replace Review UI template overrides under workspace templates/ with AFUI frontends at .afui/frontends/afmail/<ui_kind>/, declared against Review UI API version 1, with per-file fallback to the built-in localized pack; content templates stay in the workspace tree
• Report a LAN review plan that lapses unopened as outcome expired instead of dismissed, and record cancel as a completed decision, so a caller can tell 'nobody was there' from 'someone declined to answer'
• Extend afmail doctor to smoke-render the Review UI that would actually serve each surface, reporting a broken or unloadable user frontend as its own issue rather than failing every other check
• Collapse imap.password_secret_env and smtp.password_secret_env into imap.password_secret and smtp.password_secret, which now take the AFDATA source grammar (the value, env:NAME, file:PATH#DOT_PATH, literal:VALUE); stream sources are refused in config and afmail's credential-naming rule still applies to env sources
• Accept the same source grammar for afmail api serve --access-token-secret
• Upgrade agent-first-data to 0.32.1 and agent-first-ui to 0.3.1