feat: websocket support, app lock and initial tauri additions

[shaunwarman]

• WebSocket real-time updates: Fixed authenticated WebSocket connections by passing credentials via query params (browser WebSocket API limitation). Added handling for the server's connected event auth confirmation protocol.
• App lock UX: Added 30-second grace period for lock-on-minimize to prevent locking on brief tab switches. Applies to both browser visibility change and Tauri window blur.
• Tauri desktop & mobile setup: Full Tauri 2 integration with platform-conditional compilation (#[cfg(desktop)] / #[cfg(mobile)]), split capabilities for desktop-only plugins (updater, window-state), and Android build support.
• Bug fixes: Bulk delete now refreshes inbox count, arrow key navigation highlights active message, SMTP 550 rate limit errors surface properly instead of "internal server error".
• Android compatibility: Added polyfills for structuredClone and String.replaceAll for older WebViews (API 30).
• Transient empty response guard: Inbox no longer clears when the API returns a transient empty result for a basic folder query with cached data present.