fix: security audit round 5 + email display bugs

[adrgs]

Summary

• SMTP bounded read: Replace unbounded read_line() with read_line_limited() using fill_buf()/consume() — prevents OOM from newline-free input (AIS-ASO-REF-003)
• SMTP whitespace preservation: Use trim_end() instead of trim() in DATA mode to preserve MIME header folding — fixes HTML/text body extraction for multipart emails
• Cache double-count fix: Subtract old entry size before limit check in set() — prevents false "storage exceeded" on key replacement (AIS-ASO-REF-004)
• Blocked headers expansion: Block Set-Cookie, Location, CSP on main domain /r/ routing (AIS-ASO-REF-009)
• JWT_SECRET validation: Reject known placeholders and enforce min 32 chars at startup (AIS-ASO-REF-002)
• Sentry scrubbing: Strip token/share params from all breadcrumb types + event.request.url (AIS-ASO-REF-005)
• Frontend email display: Fix text tab fallback showing raw email, remove squished base64 block from Raw SMTP view
• jsonwebtoken: Bump 9.2 → 9.3 for CVE-2026-25537 patch

Test plan

• cargo clippy -- -D warnings passes
• cargo test — 79 passed, 0 failed
• bun run lint + bun run tsc --noEmit — clean
• Manual: send multipart email, verify HTML tab renders correctly
• Manual: verify Raw SMTP Transaction is readable (no squished base64)

🤖 Generated with Claude Code