Cache mail and verify local model downloads

[SebastianBoehler]

Summary

Addresses the remaining #43 items around mail transfer, mail/Campus caching, and local model catalog/download safety in one PR.

Changes:

• avoid full BODY.PEEK[] mail downloads for summaries by fetching selected headers plus a bounded 4 KB text preview
• avoid full-message detail downloads by fetching headers plus a bounded 64 KB body preview
• add short in-memory TTL caching for mailboxes, mail summaries, message details, and mailbox snapshots
• require an active profile/password before serving cached mail data, so clearing credentials does not leave cached mail readable
• add Campus menu TTL caching with manual refresh bypass
• replace non-downloadable/default-less local model catalog entries with a verified downloadable Gemma 4 E2B LiteRT-LM entry and custom import
• pass expected model size/hash metadata through Dart -> native Android download calls
• verify expected byte size and optional SHA-256 during Android model downloads, and persist verification metadata
• add focused tests for mail preview parsing, mail cache reuse/refresh, Campus cache reuse/refresh, and catalog sanity

Model source

The Gemma 4 E2B LiteRT-LM URL and current advertised size were checked against the public Hugging Face model resolver/API:

• https://huggingface.co/litert-community/gemma-4-E2B-it-litert-lm
• resolver advertised content-length: 2588147712 for gemma-4-E2B-it.litertlm

No SHA-256 is hardcoded for that model because the registry metadata did not clearly expose a standard SHA-256 checksum. The native path supports SHA-256 verification for future entries or custom metadata.

Validation

• git diff --check
• grep audit confirmed BODY.PEEK[], lfm2-5-1-2b, and qwen3-1-7b no longer appear in app source
• self-review pass for mail cache credential gating and Android partial-download cleanup

Not run in this runtime:

• Flutter/Dart tests: dart and flutter are not installed
• Android Gradle/Kotlin compile: JAVA_HOME/java are not installed