feat(PROJ-21): Phase 2+3+5+8 Multi-Tenancy + PROJ-2 EML/MBOX Upload

Phase 2a: userstore domain_admin/superadmin Rollen, User.TenantID,
          ListByTenant, UpsertLDAPUser mit tenantID
Phase 2b: storage.Save() mit tenantID *int64, email_refs Tabelle,
          GetTenantForMail, GetAllIDsByTenant, StatsByTenant
Phase 2c: JWT-Claims tenant_id/tenant_slug, Session.TenantID,
          Login Domain-Erkennung via E-Mail-Domain
Phase 3:  tenantMiddleware, Handler-Filterung (Users, Mail, Stats)
Phase 5:  SMTP Domain-Routing via DomainToTenantFunc Callback,
          config smtp.tenant_routing + default_tenant_id
Phase 8:  archivmail migrate-tenants Subkommando
PROJ-2:   Upload-Seite /admin/upload mit DropZone + Progress-Polling

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cmd/archivmail-import/main.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"context"
 	"flag"
 	"fmt"
 	"log/slog"
@@ -33,11 +34,16 @@ func main() {
 		os.Exit(1)
 	}
 
-	mailStore, err := storage.New(cfg.Storage.StorePath)
+	mailStore, err := storage.New(storage.Config{
+		Dir:     cfg.Storage.StorePath,
+		Keyfile: cfg.Storage.Keyfile,
+		DSN:     cfg.Database.DSN(),
+	})
 	if err != nil {
 		logger.Error("storage init failed", "err", err)
 		os.Exit(1)
 	}
+	defer mailStore.Close()
 
 	indexBackend := cfg.Index.Backend
 	if indexBackend == "" {
@@ -101,7 +107,7 @@ func main() {
 			continue
 		}
 
-		id, err := mailStore.Save(raw, pm.Date)
+		id, err := mailStore.Save(context.Background(), raw, pm.Date, nil)
 		if err != nil {
 			logger.Error("save failed", "path", path, "err", err)
 			errors++