fix: address all 12 PR review findings

[seanb4t]

Summary

Addresses all 12 findings from the PR #5 code review, organized by severity:

Critical (P0) — Data integrity

• SetKeywords RFC compliance: Sends nil (JSON null) instead of false to remove keywords per RFC 8621 §4.1.1
• Delete safety: Propagates transient resolveMailbox errors instead of silently falling through to permanent destroy()
• MCP type safety: Argument helpers return type-mismatch errors instead of silently returning defaults

Important (P2) — Validation & correctness

• Vacation flags: --enable/--disable enforced as mutually exclusive via Cobra
• MCP mail_flag: Validates read/unread and flagged/unflagged mutual exclusivity
• MCP resources: Return actual errors instead of fake success with error text in body
• Filter mutation: SearchWithFilter deep-copies filter map before modifying
• convertEmails: Returns ([]Email, error) instead of writing to stderr
• --force consistency: mailbox delete without --force returns error (matches mail delete)

Suggestions (P3) — Code quality

• Move optimization: Removes redundant Get call before Email/set
• oops migration: internal/jmap/ migrated from fmt.Errorf to samber/oops
• Error context: All 22 getAccountID call sites wrapped with operation context

Test plan

• All existing tests pass with -race across all 9 packages
• New tests added for every fix (TDD — tests written before implementation)
• Each fix independently code-reviewed by separate agent
• Lint clean (2 pre-existing gocognit warnings on calendar handlers)
• go build ./... compiles cleanly

🤖 Generated with Claude Code