Merge branch 'dev' into review/pewds-pr6738-terra-20261027

Integrate PR #6739 foundation (backend security, bridge hardening, Python 3.11 test fixture correction) with PR #6738 remediations.
- Reconcile routes/email/email_routes.py harmonizing _LIST_LOCK and _LIST_EPOCH with #6738 cache invalidation and thread-safe mutation.
- Preserve editor-session validation, legacy-browser tool restrictions, image-tool authorization, and email cache concurrency invariants.

tests/test_auth_regressions.py

@@ -83,6 +83,7 @@ def _auth_regressions_stubs(monkeypatch):
         build_chat_url=MagicMock(),
         build_models_url=MagicMock(),
         build_headers=MagicMock(),
+        resolve_owner_registered_endpoint_url=MagicMock(),
     )
     # _ensure_stub now registers each stub through monkeypatch itself, so the
     # whole set is undone at teardown. Re-setting them here would capture the