- Add `mail download` to save attachments by IMAP UID - Switch inbox/read/reply/forward to real IMAP UID (stable across sessions) - Add MIME header decoding for non-ASCII filenames - Add safe_filename() to prevent path traversal - Use readonly mode for inbox/list/read to avoid marking unseen