Fix inbound-email data loss, MIME truncation, and header injection

- server/data.js: preserve source/htmlBody/inboundTo/messageId across
  server restarts (sanitizeLoadedContactSubmissions was silently
  dropping them on reload from disk)
- cloudflare/email-worker.js: rewrite MIME parsing to split on the
  actual boundary marker instead of any literal "--", unfold
  multi-line headers, and correctly recombine multi-byte UTF-8 in
  quoted-printable decoding
- server/routes/inbound-email.js: validate Message-ID against RFC 5322
  grammar before storing/using it, and compare the webhook secret with
  timingSafeEqual to match the rest of the codebase's auth checks
- server/routes/contact.js: re-validate messageId at the point it's
  injected into outgoing In-Reply-To/References headers; move the
  allowed reply-from addresses into a shared config constant
- src/AdminPage.tsx: 30s inbox poll now syncs field updates (e.g.
  archived) on already-loaded submissions instead of only appending
  new ones; consolidate the duplicated from-address list
- .claude/launch.json: add a vite dev server preview config used to
  verify these changes

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

server/data.js

@@ -1048,6 +1048,10 @@ function sanitizeLoadedContactSubmissions(value) {
       subscribe: entry.subscribe === true,
       archived: entry.archived === true,
       emailStatus: normalizeContactEmailStatus(entry.emailStatus, entry.subscribe === true),
+      source: entry.source === 'inbound-email' || entry.source === 'download' ? entry.source : 'contact-form',
+      htmlBody: typeof entry.htmlBody === 'string' && entry.htmlBody.trim() ? entry.htmlBody : null,
+      inboundTo: typeof entry.inboundTo === 'string' ? entry.inboundTo : '',
+      messageId: typeof entry.messageId === 'string' ? entry.messageId : '',
     }))
 }