feat: add delegated contact API

[salmonumbrella]

Summary

Adds thread-stable delegated-contact persistence and a bulk backend API, including ownership validation, immutable contact snapshots, lifecycle cleanup, read-surface enrichment, and IMAP/database compensation.

This is PR 5 of the cumulative command-system roadmap. Please review the last commit only: 2434925.

Closes #342.

Changes

• add migration 0040_gtd_delegations.sql with user/account/thread ownership and contact snapshots
• add POST /api/gtd/delegations with deduplicated 1–100 message batches and structured partial results
• serialize per-thread COPY operations, await shared folder syncs, and compensate only exact request-owned UIDs
• reconcile metadata after manual, automatic, and external Delegated-label removal without deleting surviving assignments
• expose delegation metadata through GTD sections, message lists, single-message/thread resolution, and search
• preserve snapshots after contact deletion and reset delegation age only when the selected contact changes

Testing

• npm run lint (backend, zero warnings)
• Node 22: 51 files / 1,014 backend tests passed
• focused final review suites: 212 tests passed
• isolated Compose candidate build and health check
• fresh PostgreSQL migration schema verification
• authenticated endpoint smoke tests for validation and sanitized not_found bulk results

---

Contributor License Agreement

By submitting this pull request I confirm that:

• I have read and agree to the Contributor License Agreement.
• My contribution is my own original work (or I have identified any
  third-party material and confirmed it is compatible with the CLA).
• I have the right to submit this contribution under the terms of the CLA.