JMAP-first communication runtime
Credentials validated against Stalwart JMAP — never stored in the browser.