security: Zufallspasswörter beim Erststart, kryptographisch sichere JTI-Generierung

- seedDefaultUsers: generiert kryptographisch zufällige Passwörter (crypto/rand)
  statt hartkodiertes "archivmailrockz" — Passwörter werden einmalig im Terminal
  angezeigt und können danach nicht wiederhergestellt werden
- generateJTI: verwendet crypto/rand (16 Byte, hex) statt time.UnixNano XOR deadbeef

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/index/xapian_wrapper.h

@@ -10,19 +10,24 @@ typedef struct XapianDB XapianDB;
 XapianDB* xapian_open(const char* path, int writable, char** err);
 void      xapian_close(XapianDB* db);
 
+/* has_attachment: 0=no attachment, 1=has attachment */
 int  xapian_index(XapianDB* db, const char* id, const char* from,
                    const char* to, const char* subject, const char* body,
-                   long long timestamp, char** err);
+                   long long timestamp, int has_attachment, char** err);
 
 int  xapian_delete(XapianDB* db, const char* id, char** err);
 
 /* Returns JSON string: {"total":N,"hits":[{"id":"...","score":0.9},...]}
-   Returns NULL on error, sets *err. Caller must free with xapian_free_string. */
+   Returns NULL on error, sets *err. Caller must free with xapian_free_string.
+   sort_mode:     0=relevance, 1=date_desc, 2=date_asc
+   has_attachment: 0=all, 1=only with attachment, -1=only without */
 char* xapian_search(XapianDB* db, const char* query,
                      const char* from_filter, const char* own_email,
                      const char* to_filter,
                      long long date_from, long long date_to,
-                     int offset, int limit, char** err);
+                     int offset, int limit,
+                     int sort_mode, int has_attachment,
+                     char** err);
 
 void xapian_free_string(char* s);