Add dark mode, fix security bugs
- Dark mode with ThemeContext/ThemeToggle (matches SaaS dashboard)
- Anti-flash script in index.html (no white flash on load)
- Fix: weak email regex → validator.isEmail() in reply handler
- Fix: SMTP password silently lost when masked placeholder sent
- Fix: sanitizeFilename missing path.basename() (latent path traversal)
- Fix hardcoded bg-white/gray colors in dark mode incompatible components