[feat] Implement WebAuthn PRF for Server-Side Encryption at Rest

**Current Architecture:**
The server-side SQLite mailbox currently utilizes a key derived from an IMAP password for encryption at rest. WebAuthn PRF is deployed for the client-side App Lock feature, but the server-side storage requires password transmission and retention in active memory for database decryption during web or IMAP sessions.

**Proposed feature:**
Integrate the WebAuthn PRF extension to derive the primary decryption key for the server-side SQLite mailboxes, enabling direct database unlocking via hardware authenticators for webmail access.

**Technical rationale:**

* **Zero-Knowledge Web Sessions:** Deriving the key locally via PRF allows the web application to unlock the server database without transmitting or storing a plaintext password in the server's RAM.
* **Phishing Immunity:** The hardware authenticator generates the key locally. Phishing domains cannot extract the underlying password or private key.
* **Cryptographic Domain Binding:** The PRF extension binds the cryptographic salt to the specific relying party domain. Requests from spoofed domains generate mathematically invalid keys.
* **Separation of Concerns:** Authentication (proving possession via cryptographic signature) is isolated from decryption (deriving the database key via PRF).

**Implementation:**

1. Enable PRF key derivation to serve as the master key for the server-side ChaCha20-Poly1305 encryption.
2. Restrict standard password-derived keys strictly as a fallback mechanism for legacy clients connecting via IMAP/POP3/SMTP protocols.
3. Ensure the server only receives the derived key required to unlock the SQLite instance during active web sessions, discarding it upon session termination.

Start by tracing the server-side SQLite mailbox encryption and reviewing the existing client-side WebAuthn PRF implementation used for App Lock. Define how PRF-derived keys, legacy password-derived keys, active web sessions, and session termination should interact; done means web sessions can unlock the database without retaining a plaintext password while legacy IMAP, POP3, and SMTP clients still use the fallback.

Written by the indexing model from the issue text.