RustBox 0.2.10 - final source validation

0.2.10 scope:
- message-body links without an explicit target open outside the sandboxed preview in a new tab/window, while explicit targets are preserved
- page refresh/session restoration does not emit a false “Successfully logged in” toast
- real login still emits the success toast
- message preview documents explicitly use UTF-8 and RFC 2047 headers support UTF-8, ISO-8859-2 and Windows-1250 decoding
- PDF attachment preview uses the authenticated inline URL for Safari/iPhone compatibility
- Composing shows only compact attachment/message size-limit values on one line
- 0.2.9 realtime notification gating, browser shortcut preservation and 300-message defaults remain intact
- no runtime schema migration is added; V049 remains next
- version metadata updated to 0.2.10

Completed in this environment:
- offline release validator: scripts/validate-release-static.py (351/351 checks passed)
- browser JavaScript assembled in manifest order passes `node --check`
- all JSON files parse successfully
- Python helper scripts compile successfully
- shell scripts pass `bash -n`
- release metadata consistently identifies 0.2.10
- V048 migration files/catalog registration and SQLite upgrade execution are validated offline


Not executable in this packaging environment:
- cargo fmt/test/clippy/build with Rust 1.99.1, because Rust/Cargo is not installed
- live PostgreSQL/MySQL/S3/NFS/OpenSearch/IMAP integration tests

The final release gate on a Rust host is:
  bash scripts/build-release.sh

This file intentionally does not claim blocked runtime/integration checks as passed.