FRE-681: Fix security review findings (3 HIGH, 3 MEDIUM, 2 LOW)

HIGH fixes:
- Access Token now used as PGP Passphrase: replaced session.AccessToken
  with session.MailPassphrase for all PGP operations
- Session stored encrypted in keyring and file (was plain JSON)
- Added checkAuthenticated() helper with IsAuthenticated() guard

MEDIUM fixes:
- Added MailPassphrase field to Session, collected during login
- Added email validation in LoginInteractive
- Added keyring cleanup on Logout
- Implemented RefreshToken with actual API call

LOW fixes:
- Added mutex to PGPKeyRing for thread safety
- Added ZeroPrivateKeyData() for memory cleanup
- Use net/mail.ParseAddress for proper recipient parsing
- Renamed internal/mail import to internalmail to avoid conflict

internal/mail/client.go

@@ -122,7 +122,7 @@ func (c *Client) GetMessage(messageID string, passphrase string) (*Message, erro
 
 func (c *Client) Send(req SendRequest) error {
 	payload := map[string]interface{}{
-		"Type":       "0",
+		"Type":       MessageTypeRegular,
 		"Passphrase": req.Passphrase,
 		"Subject":    req.Subject,
 		"HTML":       req.HTML,
@@ -222,7 +222,7 @@ func (c *Client) PermanentlyDelete(messageID string) error {
 
 func (c *Client) SaveDraft(draft Draft, passphrase string) (string, error) {
 	body := map[string]interface{}{
-		"Type":       "2",
+		"Type":       MessageTypeDraft,
 		"Passphrase": passphrase,
 		"Subject":    draft.Subject,
 		"To":         draft.To,