security: Zufallspasswörter beim Erststart, kryptographisch sichere JTI-Generierung

- seedDefaultUsers: generiert kryptographisch zufällige Passwörter (crypto/rand)
  statt hartkodiertes "archivmailrockz" — Passwörter werden einmalig im Terminal
  angezeigt und können danach nicht wiederhergestellt werden
- generateJTI: verwendet crypto/rand (16 Byte, hex) statt time.UnixNano XOR deadbeef

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/api/server.go

@@ -398,6 +398,8 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 	toFilter := r.URL.Query().Get("to")
 	dateFromStr := r.URL.Query().Get("date_from")
 	dateToStr := r.URL.Query().Get("date_to")
+	sortParam := r.URL.Query().Get("sort") // "relevance", "date_asc", "date_desc"
+	hasAttachStr := r.URL.Query().Get("has_attachment") // "true" or "false"
 	pageStr := r.URL.Query().Get("page")
 	pageSizeStr := r.URL.Query().Get("page_size")
 
@@ -409,10 +411,19 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 
 	req := index.SearchRequest{
 		Query:    q,
+		Sort:     sortParam,
 		PageSize: pageSize,
 		Page:     page,
 	}
 
+	if hasAttachStr == "true" {
+		v := true
+		req.HasAttachment = &v
+	} else if hasAttachStr == "false" {
+		v := false
+		req.HasAttachment = &v
+	}
+
 	// Domain search: @domain.de matches both From AND To fields.
 	// A value starting with '@' triggers OR-search across XF and XT prefixes.
 	if strings.HasPrefix(fromFilter, "@") || strings.HasPrefix(toFilter, "@") {
@@ -458,19 +469,22 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 		Success:   true,
 	})
 
-	// Enrich hits with metadata (from, subject, date) by parsing each mail.
+	// Enrich hits with metadata (from, subject, date, size, attachments).
 	type enrichedHit struct {
-		ID      string  `json:"id"`
-		Score   float64 `json:"score"`
-		From    string  `json:"from,omitempty"`
-		To      string  `json:"to,omitempty"`
-		Subject string  `json:"subject,omitempty"`
-		Date    string  `json:"date,omitempty"`
+		ID             string  `json:"id"`
+		Score          float64 `json:"score"`
+		From           string  `json:"from,omitempty"`
+		To             string  `json:"to,omitempty"`
+		Subject        string  `json:"subject,omitempty"`
+		Date           string  `json:"date,omitempty"`
+		Size           int64   `json:"size,omitempty"`
+		HasAttachments bool    `json:"has_attachments"`
 	}
 	enriched := make([]enrichedHit, 0, len(result.Hits))
 	for _, h := range result.Hits {
 		eh := enrichedHit{ID: h.ID, Score: h.Score}
 		if raw, err := s.store.Load(h.ID); err == nil {
+			eh.Size = int64(len(raw))
 			if pm, err := mailparser.Parse(raw); err == nil {
 				eh.From = pm.From
 				if len(pm.To) > 0 {
@@ -480,6 +494,7 @@ func (s *Server) handleSearch(w http.ResponseWriter, r *http.Request) {
 				if !pm.Date.IsZero() {
 					eh.Date = pm.Date.UTC().Format(time.RFC3339)
 				}
+				eh.HasAttachments = len(pm.Attachments) > 0
 			}
 		}
 		enriched = append(enriched, eh)
@@ -1215,6 +1230,7 @@ var excludedFSTypes = map[string]bool{
 	"efivarfs": true, "bpf": true, "hugetlbfs": true, "mqueue": true,
 	"ramfs": true, "devpts": true, "fusectl": true, "configfs": true,
 	"autofs": true, "nsfs": true, "rpc_pipefs": true,
+	"fuse.lxcfs": true, "fuse": true,
 }
 
 func (s *Server) handleSystemStats(w http.ResponseWriter, r *http.Request) {
@@ -1251,7 +1267,8 @@ func (s *Server) handleSystemStats(w http.ResponseWriter, r *http.Request) {
 
 	// Disks: /proc/mounts + syscall.Statfs
 	var disks []diskStat
-	seenMounts := map[string]bool{}
+	seenMounts := map[string]bool{}  // deduplicate by mountpoint
+	seenDevices := map[string]bool{} // deduplicate by device (catches ZFS bind-mounts)
 	if data, err := os.ReadFile("/proc/mounts"); err == nil {
 		scanner := bufio.NewScanner(strings.NewReader(string(data)))
 		for scanner.Scan() {
@@ -1259,9 +1276,10 @@ func (s *Server) handleSystemStats(w http.ResponseWriter, r *http.Request) {
 			if len(fields) < 3 {
 				continue
 			}
+			device := fields[0]
 			mount := fields[1]
 			fstype := fields[2]
-			if excludedFSTypes[fstype] || seenMounts[mount] {
+			if excludedFSTypes[fstype] || seenMounts[mount] || seenDevices[device] {
 				continue
 			}
 			seenMounts[mount] = true
@@ -1272,6 +1290,10 @@ func (s *Server) handleSystemStats(w http.ResponseWriter, r *http.Request) {
 			total := stat.Blocks * uint64(stat.Bsize)
 			free := stat.Bavail * uint64(stat.Bsize)
 			used := total - free
+			if total == 0 {
+				continue // skip pseudo-mounts with no storage (e.g. lxcfs overlays)
+			}
+			seenDevices[device] = true
 			var usedPct float64
 			if total > 0 {
 				usedPct = math.Round(float64(used)/float64(total)*1000) / 10