Sync main with develop (release 0.17.2) - #199

Bumps the development-updates group with 1 update in the /frontend directory: [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `vite` from 8.3.0 to 8.3.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…dvisories (#196)

npm audit fix bumps the transitive dev dependency brace-expansion past
5.0.11, fixing three DoS advisories (GHSA-q2hr-2g5m-vwhr,
GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p). Lockfile-only change.

… with 3 updates (#193)

* chore(deps-backend)(deps): bump the minor-and-patch group

Bumps the minor-and-patch group in /backend with 3 updates: [uvicorn](https://github.com/Kludex/uvicorn), [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) and [coverage](https://github.com/coveragepy/coveragepy).


Updates `uvicorn` from 0.53.0 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.53.0...0.54.0)

Updates `sqlalchemy` from 2.0.54 to 2.1.1
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `coverage` from 7.16.1 to 7.16.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.16.1...7.16.2)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sqlalchemy
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: coverage
  dependency-version: 7.16.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(deps): require sqlalchemy[asyncio] extra for SQLAlchemy 2.1

SQLAlchemy 2.1 no longer installs greenlet by default, which broke
sqlalchemy.ext.asyncio at import time. Use the asyncio extra and
update docs/REQUIREMENTS.md accordingly.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: 0verwrite <31691645+overwrite00@users.noreply.github.com>

…omation (#198)

* fix(ci): use the workflow token for PR and issue edits in project automation

The step ran every gh command with GH_PROJECT_TOKEN, a token scoped to
Projects, so assignee, reviewer and label edits failed on every pull request.
Their errors were discarded by 2>/dev/null and replaced by a generic 'skipped'
message, so the failure went unnoticed.

Use the workflow's own token (the permissions block already grants it
issues/pull-requests write) for repository edits and keep the PAT only for the
Projects mutation. Failures are now reported as warnings with gh's error
message, and the reviewer request is skipped when the author is the assignee,
which GitHub rejects.

* fix(ci): assign Dependabot PRs natively and skip edits its token cannot make

GitHub gives Dependabot-triggered workflows a read-only GITHUB_TOKEN, so the
assignee, reviewer and label edits cannot work for its pull requests and
would only produce warnings on every run. Dependabot PRs had never been
assigned.

Set assignees in dependabot.yml for all three ecosystems (labels were already
set there) and make the workflow skip those edits for Dependabot authors with
an explicit message. Adding the PR to the Project is unchanged.

…rom .msg files (#197)

* test: add synthetic .msg fixture and enable the .msg parsing test

test_msg_parsing_via_email_parser looked for samples/sample.msg, a
gitignored directory, so it was skipped everywhere including CI. Add a
deterministic synthetic fixture (reserved example domains only) with a
generator script, point the test at it with real assertions, and add a
check that the committed binary matches the generator output.

* fix(msg): extract recipients, transport headers and RTF-only bodies from .msg files

python-oxmsg exposes recip.email_address, not .email, and Properties has no
.get(), so recipients and the raw transport headers were always empty for
every .msg. Both failures were swallowed by bare except clauses. As a result
SPF/DKIM/DMARC, Message-ID and the Received chain were never extracted and
header scoring ran without authentication data. _parse_msg also copied only
6 of the 18 header-derived ParsedEmail fields.

- read recipients and headers with the correct API, drop the bare excepts and
  report failures through MsgFields.errors
- copy every header-derived field via _MSG_HEADER_DERIVED_FIELDS, guarded by a
  test that fails when a new ParsedEmail field is left unclassified
- make the RTF-only path work: the RTFDE import was wrong and its ImportError
  was reported as 'not installed'; add MS-OXRTFCP decompression and use
  DeEncapsulator
- install RTFDE (optional, LGPL) in the CI test job so its end-to-end test runs
- bump version to 0.17.2 and update CHANGELOG, README and docs

* docs: note native Dependabot assignment in the 0.17.2 changelog