feat(messages): Phase 1 read-only Messages viewer (email client shell)

New admin "Messages" page — a three-pane mail viewer over the mail picpeak
already stores, feature-flagged behind `messaging` (default off):

- Sidebar account tree: All mail / Customers (hello@) / Accounting (rechnungen@)
  / Automated (no-reply@), matching the agreed IA.
- Automated + All Sent = email_queue (listQueue); Accounting + All Inbox =
  received_emails (listReceived). Customers folders show an explanatory empty
  state pending the hello@ mailbox (Phase 2).
- Reading pane renders the sent body from rendered_html (migration 119) in a
  sandboxed iframe; new GET /admin/email/queue/:id returns body + cc +
  attachment filenames (disk paths never exposed).
- Received supplier invoices: envelope + rasterized PDF viewer reusing the
  accounting inbound blob endpoint, plus "Open in Accounting inbox".
- Context toolbar (Reply/Forward/Create Quote-Contract-Gallery-Invoice /
  Book-as-expense-Re-bill) present but disabled — wired in later phases.

Reuses email.service, accounting inbound blob endpoint, RequireFeature +
PermissionGate (email.view), Tailwind dark: theming. No schema change.

frontend/src/i18n/locales/de.json

@@ -197,6 +197,7 @@
   "navigation": {
     "dashboard": "Dashboard",
     "events": "Veranstaltungen",
+    "messages": "Nachrichten",
     "settings": "Einstellungen",
     "systemHealth": "Systemzustand",
     "archives": "Archive",

frontend/src/i18n/locales/en.json

@@ -198,6 +198,7 @@
     "dashboard": "Dashboard",
     "events": "Events",
     "archives": "Archives",
+    "messages": "Messages",
     "settings": "Settings",
     "systemHealth": "System health",
     "eventTypes": "Event Types",