feat(onboarding): implement account wizard with provider presets

Completes the accounts-dialog OpenSpec change (33/33 tasks).

- mailbrus-core: per-account TOML config (SMTP fields, signature,
  email-as-id), atomic write, keyring/plain credential write,
  connection-test (IMAP + SMTP AUTH), unit tests for all paths
- mailbrus-server: reloadable AppState via arc_swap, GET/POST
  /api/accounts endpoints, rustls ring CryptoProvider init at startup
- OnboardingWizard: provider preset dropdown (Gmail, Outlook/Hotmail,
  Yahoo Mail, iCloud, Fastmail) auto-fills IMAP/SMTP; Advanced toggle
  for manual override; app-password notes for providers that require them
- StatusBar hidden during onboarding; renders only after mailbox loads
- E2E: onboarding happy path + 422/409 negative paths

Author: antono

Cargo.lock

@@ -1,13 +1,10 @@
 /**
- * Generate a mailbrus config.toml that mirrors the cloned corpus's account
- * layout. The server uses this to populate `/api/maildirs`; existing tests
- * that previously relied on filesystem-based account discovery now drive the
- * same data through the typed config.
- *
- * The IMAP fields are placeholders — they are only used if a sync is
- * triggered, which existing tests do not do.
+ * Generate per-account TOML files under `accounts/` that mirror the cloned
+ * corpus. The new config format uses one flat `<email>.toml` per account
+ * (no `[accounts.X]` wrapper). The `--config` flag takes the base directory;
+ * accounts are discovered by scanning `<dir>/accounts/*.toml`.
  */
-import { readdir, writeFile } from 'node:fs/promises';
+import { mkdir, readdir, writeFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import type { Clone } from './clone.ts';
 
@@ -18,7 +15,10 @@ export interface ConfigEntry {
 }
 
 export interface ConfigHandle {
+	/** Base config directory (passed to --config). Contains accounts/ inside. */
 	path: string;
+	/** Accounts subdirectory: write extra *.toml files here to add accounts. */
+	accountsDir: string;
 	entries: ConfigEntry[];
 }
 
@@ -39,15 +39,9 @@ function escape(s: string): string {
 	return s.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-/**
- * Build an account section. `id` is used as the TOML table key and as the
- * `email` placeholder — most tests assert `id == address`, which the existing
- * filesystem path produced naturally.
- */
-function renderAccount(entry: ConfigEntry): string {
-	const idKey = /^[A-Za-z0-9_-]+$/.test(entry.id) ? entry.id : `"${escape(entry.id)}"`;
+/** Flat per-account TOML (no [accounts.X] wrapper). Filename stem = id = email. */
+export function renderAccountToml(entry: ConfigEntry): string {
 	return [
-		`[accounts.${idKey}]`,
 		`protocol = "imap"`,
 		`email = "${escape(entry.id)}"`,
 		`imap_host = "imap.invalid"`,
@@ -60,11 +54,35 @@ function renderAccount(entry: ConfigEntry): string {
 	].join('\n');
 }
 
-/** Write a fresh config.toml at `<clone.root>/mailbrus-config.toml`. */
+/**
+ * Write a per-account TOML file into `accountsDir/<entry.id>.toml`.
+ * Call after `writeFixtureConfig` to inject extra accounts (e.g. a
+ * Stalwart-backed test account) without rebuilding the whole config.
+ */
+export async function addAccountToml(
+	accountsDir: string,
+	entry: ConfigEntry & { toml?: string }
+): Promise<void> {
+	const body = entry.toml ?? renderAccountToml(entry);
+	await writeFile(join(accountsDir, `${entry.id}.toml`), body);
+}
+
+/** Write fixture config with all accounts from the cloned corpus. */
 export async function writeFixtureConfig(clone: Clone): Promise<ConfigHandle> {
 	const entries = await scanAccounts(clone);
-	const body = entries.map(renderAccount).join('\n');
-	const path = join(clone.root, 'mailbrus-config.toml');
-	await writeFile(path, body);
-	return { path, entries };
+	const configDir = join(clone.root, 'mailbrus-config');
+	const accountsDir = join(configDir, 'accounts');
+	await mkdir(accountsDir, { recursive: true });
+	for (const entry of entries) {
+		await addAccountToml(accountsDir, entry);
+	}
+	return { path: configDir, accountsDir, entries };
+}
+
+/** Write a config directory with an empty accounts/ (zero-account onboarding state). */
+export async function writeEmptyFixtureConfig(clone: Clone): Promise<ConfigHandle> {
+	const configDir = join(clone.root, 'mailbrus-config');
+	const accountsDir = join(configDir, 'accounts');
+	await mkdir(accountsDir, { recursive: true });
+	return { path: configDir, accountsDir, entries: [] };
 }

e2e/harness/config.ts

@@ -0,0 +1,88 @@
+// openspec/changes/accounts-dialog/specs/onboarding-wizard/spec.md
+import { expect, type Page } from '@playwright/test';
+
+export interface AccountFormFields {
+	email: string;
+	imapHost: string;
+	imapPort?: number;
+	imapTls?: boolean;
+	secret: string;
+	displayName?: string;
+	smtpHost?: string;
+}
+
+export class OnboardingPage {
+	constructor(private readonly page: Page) {}
+
+	/** Navigate to '/' and assert the wizard is shown (not the mailbox). */
+	async open(): Promise<void> {
+		await this.page.goto('/');
+		await expect(this.page.getByTestId('onboarding-wizard')).toBeVisible();
+	}
+
+	/** Assert wizard is visible without navigating. */
+	async expectVisible(): Promise<void> {
+		await expect(this.page.getByTestId('onboarding-wizard')).toBeVisible();
+	}
+
+	/** Assert wizard is gone (mailbox has taken over). */
+	async expectDismissed(): Promise<void> {
+		await expect(this.page.getByTestId('onboarding-wizard')).not.toBeVisible({ timeout: 10_000 });
+	}
+
+	/** Fill the required form fields. */
+	async fillForm(fields: AccountFormFields): Promise<void> {
+		await this.page.getByTestId('onboarding-wizard.email').fill(fields.email);
+		await this.page.getByTestId('onboarding-wizard.imap-host').fill(fields.imapHost);
+		if (fields.imapPort !== undefined) {
+			await this.page.getByTestId('onboarding-wizard.imap-port').fill(String(fields.imapPort));
+		}
+		if (fields.imapTls !== undefined) {
+			const checkbox = this.page.getByTestId('onboarding-wizard.imap-tls');
+			const checked = await checkbox.isChecked();
+			if (checked !== fields.imapTls) await checkbox.click();
+		}
+		await this.page.getByTestId('onboarding-wizard.secret').fill(fields.secret);
+		if (fields.displayName) {
+			await this.page.getByTestId('onboarding-wizard.display-name').fill(fields.displayName);
+		}
+		if (fields.smtpHost) {
+			await this.page.getByTestId('onboarding-wizard.smtp-host').fill(fields.smtpHost);
+		}
+	}
+
+	/** Click the submit button. */
+	async submit(): Promise<void> {
+		await this.page.getByTestId('onboarding-wizard.submit').click();
+	}
+
+	/** Wait for "Account added" success phase. */
+	async expectCreated(): Promise<void> {
+		await expect(this.page.getByTestId('onboarding-wizard.created')).toBeVisible({ timeout: 20_000 });
+	}
+
+	/** Click "Sync now" and wait until it transitions to "Go to inbox". */
+	async syncNow(): Promise<void> {
+		await this.page.getByTestId('onboarding-wizard.sync-now').click();
+		await expect(this.page.getByTestId('onboarding-wizard.go-to-inbox')).toBeVisible({ timeout: 30_000 });
+	}
+
+	/** Click "Go to inbox" — triggers onAccountReady and dismisses the wizard. */
+	async goToInbox(): Promise<void> {
+		await this.page.getByTestId('onboarding-wizard.go-to-inbox').click();
+	}
+
+	/** Field-level validation error for a given field id (e.g. 'email', 'imap-host'). */
+	async fieldError(field: string): Promise<string | null> {
+		const locator = this.page.getByTestId(`onboarding-wizard.${field}-error`);
+		const visible = await locator.isVisible();
+		return visible ? (await locator.textContent()) ?? null : null;
+	}
+
+	/** Form-level (non-field) error. */
+	async formError(): Promise<string | null> {
+		const locator = this.page.getByTestId('onboarding-wizard.form-error');
+		const visible = await locator.isVisible();
+		return visible ? (await locator.textContent()) ?? null : null;
+	}
+}