Fix native client OAuth lifetime and Mail API gaps

[bermanto]

Offline OAuth clients lose access when the approving browser session expires, and the draft response schema conflicts with its signature snapshot. Fix both defects, add signature management under a separate signatures:manage permission, and let v1 clients request label membership with includeLabels=true.

• Preserve offline grants after browser expiry or sign-out. Keep token expiry, consent, account, and mailbox checks; revoke tokens and approvals on password reset.
• Separate DraftFields, write-time signature selection, and saved signature snapshots in both OpenAPI documents.
• Reuse the signature service, role checks, sanitizer, and audits on both API versions. Machine credentials cannot manage signatures.
• Keep default v1 responses unchanged and preserve label opt-in in page links. Update generated OpenAPI/Postman files and the consent and Connections text.

Fixes #112, #113, #114, and #115.

This PR builds on #116 and targets fix/audit-reliability. Review that PR first, then retarget this PR to main after it merges. Canonical documentation: HQBase/hqbase-site#50.

Validation: pnpm check passed (887 unit tests and 222 Worker integration tests; 2 unit tests skipped). pnpm deploy:dry-run passed. The site pnpm check passed. A deployed native-client regression test covers signature CRUD, decoding a saved draft after signature deletion, v1 label opt-in, refresh after web sign-out, and connection revocation. Linux and Windows CI passed on commit 885433d48db103310f4da6f2f0b14fd874f9a7e6. Staging E2E passed on the same commit, including the deployed native-client test, resource recovery, populated upgrade, hostname move/restore, backup/restore, and cleanup.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 5bfdde56-f575-45de-93aa-2041b932c906

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}