Fix inbound-email data loss, MIME truncation, and header injection

- server/data.js: preserve source/htmlBody/inboundTo/messageId across
  server restarts (sanitizeLoadedContactSubmissions was silently
  dropping them on reload from disk)
- cloudflare/email-worker.js: rewrite MIME parsing to split on the
  actual boundary marker instead of any literal "--", unfold
  multi-line headers, and correctly recombine multi-byte UTF-8 in
  quoted-printable decoding
- server/routes/inbound-email.js: validate Message-ID against RFC 5322
  grammar before storing/using it, and compare the webhook secret with
  timingSafeEqual to match the rest of the codebase's auth checks
- server/routes/contact.js: re-validate messageId at the point it's
  injected into outgoing In-Reply-To/References headers; move the
  allowed reply-from addresses into a shared config constant
- src/AdminPage.tsx: 30s inbox poll now syncs field updates (e.g.
  archived) on already-loaded submissions instead of only appending
  new ones; consolidate the duplicated from-address list
- .claude/launch.json: add a vite dev server preview config used to
  verify these changes

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/config.js

@@ -85,6 +85,9 @@ export const DEFAULT_RESEND_FROM = 'Verse by Verse with Nate <hello@versebyverse
 export const DEFAULT_RESEND_TO = 'hello@versebyversewithnate.us'
 export const DEFAULT_RESEND_REPLY_TO = 'hello@versebyversewithnate.us'
 export const ADMIN_REPLY_FROM = DEFAULT_RESEND_FROM
+export const NATE_RESEND_FROM = 'Verse by Verse with Nate <nate@versebyversewithnate.us>'
+// Addresses an admin may send a reply from — must stay in sync with the <select> options in src/AdminPage.tsx.
+export const ADMIN_REPLY_FROM_OPTIONS = [DEFAULT_RESEND_FROM, NATE_RESEND_FROM]
 
 export const DEFAULT_SEO = {
   title: 'Verse by Verse with Nate',