[Opus 4.6] Support IMAP accounts in delete-staged command

[DominicHolmes]

Human note: this fixed my use case (processing a ton of iCloud-hosted emails). Code looks reasonable to me, but I don't know golang. iCloud (IMAP) path is tested, Gmail path is untested (I don't have a gmail).

===========

Summary

• delete-staged now detects account type and routes IMAP accounts through the IMAP client path instead of always assuming Gmail OAuth
• Reuses the existing buildAPIClient factory (same one used by sync) to avoid duplicating IMAP client construction
• Preserves full Gmail scope escalation behavior (both proactive and reactive paths)

Closes #221

Testing

Tested end-to-end on a real iCloud IMAP account:

• 10-message batch: 10/10 succeeded, 0 failed (8s). Batch delete correctly fell back to per-message UID STORE \Deleted + UID EXPUNGE.
• 741-message batch: 741/741 succeeded, 0 failed (~7min). Confirmed the fallback path handles large batches reliably.
• --dry-run works correctly for IMAP accounts
• All existing tests pass (make test)
• go fmt and go vet clean

🤖 Generated with Claude Code

[roborev-ci]

roborev: Combined Review (ef50564)

Verdict: The PR successfully extends staged deletions to IMAP, but introduces a high-severity risk of targeting the wrong backend for accounts with
multiple sources.

High

• Location: cmd/msgvault/cmd/deletions.go:367
• Problem: The new source resolution picks the first
  gmail or imap source returned for an account identifier, but delete-staged still groups manifests by m.Account only. If a user has both a Gmail source and an IMAP source with the same identifier/email, this path can silently target the wrong backend and apply staged deletions against
  the wrong source.
• Fix: Make staged deletions identify the source unambiguously (for example by persisting source_id/source_type in the manifest and grouping by that), or at minimum fail when GetSourcesByIdentifier returns more than one eligible source instead of taking the first match.

---

Synthesized from 3 reviews (agents: codex, gemini | types: default, security)