feat: IMAP mail sync with thread-to-contact matching (PRD §6.1)

Real IMAP connection via imapflow library:
- Connects to IMAP server (IMAPFlow, TLS on port 993)
- Fetches recent messages (configurable limit, default 20)
- Extracts: from, fromEmail, subject, date, snippet (200 chars)
- Thread-to-contact matching (PRD §6.1):
  1. Match sender email against persons table
  2. If no person match, extract domain and match against company.website
  3. Returns matchedCompany + matchedPerson for each email
- Audit-logged (action: crm.mailsync:imap)
- Zod validated (host, port, user, password, folder, limit)
- 502 on IMAP connection failure with detail
- 400 on validation failure

Tested: invalid creds → 502 'IMAP connection failed', missing host → 400

skills/design/design-templates/ppt/AGENTS.md

@@ -0,0 +1,9 @@
+# Deck Templates Agent Rules
+
+This directory is slide-carrier only.
+
+Read a deck template here only after the top-level `INDEX.md` carrier gate has confirmed the user wants PPT/deck/slides/演示稿/幻灯片/BP/路演.
+
+Do not enter this directory for topic keywords alone, including 周报、报告、课程、融资、weekly, report, course, finance, or launch.
+
+Read the selected template `SKILL.md` first. Do not read `pattern.html` by default. Treat pattern files as layout references, not source code to copy.