feat(email): expand Outlook MSG body and attachment previews

[wybaby168]

Summary

• Complete the existing MSG preview path with Unicode/ANSI and binary HTML decoding, separate To/Cc/Bcc, on-behalf-of sender metadata, local CID/Content-Location images, lazy attachment extraction and embedded MSG previews.
• Add bounded CFB preflight and MELA/LZFu RTF decompression. Reuse the existing Word/RTF capability through renderNestedBuffer; retain readable text and explicit capability notices when rich rendering is unavailable.
• Isolate email HTML with an empty-sandbox iframe and restrictive CSP, and fix body/attachment sizing, close/focus behavior, cancellation races and resource disposal.
• Add generated CFB fixtures, focused tests, a Chromium UI gate, screenshot evidence and bilingual documentation. No runtime dependency, version, lockfile or public core API change.
• Fix a type error from the merged main baseline: remove the unsupported sourceUrl field from the nested renderNestedBuffer context in email.ts (it is not part of FileRenderContext).

Related issue

N/A: maintainer-requested completion of existing Outlook MSG preview support; no separate tracking issue was supplied.

Change classification

• User-visible UI or rendering change
• Non-visual change
• File-format or renderer behavior
• Public API, package, Worker, WASM, or deployment-path change

Package verification scripts change; runtime dependencies and public API do not.

Verification

Check	Result
pnpm --filter @file-viewer/renderer-email build	Pass
pnpm --filter @file-viewer/renderer-email type-check	Pass
node --test packages/renderers/email/test/msg.test.mjs	Pass — 53 passed, 0 failed
pnpm --filter @file-viewer/renderer-email verify:msg:browser	Pass — 34 Chromium assertions, no external requests or page errors

Sample / fixture evidence

• Fixture generator (repository path): https://github.com/flyfish-dev/file-viewer/blob/feature/outlook-msg-complete-preview/packages/renderers/email/test/fixtures/msg-fixture.mjs
• packages/renderers/email/test/fixtures/msg-fixture.mjs generates real CFB v3/v4 messages with FAT/DIFAT/MiniFAT, Unicode/ANSI properties, recipient rows, raster CID attachments, compressed RTF and embedded message storage.
• packages/renderers/email/test/msg.test.mjs includes default-on installed-MsgReader parsing and embedded-MSG extraction/reparse cases.
• Provenance and limitations: packages/renderers/email/test/fixtures/README.md. These are original Apache-2.0 fixtures using example.test, not customer emails or renamed text files.

Visual evidence

After: real Chromium UI capture, 1180 × 760 viewport, reduced to 900 × 580 for this image. It uses the explicit Reader API fixture, not an Outlook reference image or real-parser end-to-end capture. The browser gate also produces mobile and dark screenshots plus a JSON report.

Before: the reviewed MSG adapter ignored bodyHtml, treated binary html as a string, grouped all recipients into To, and did not register MSG CID resources or render its RTF body. No matched before screenshot was captured.

Risk and compatibility

• Affected packages/formats: @file-viewer/renderer-email; MSG parsing and shared EML/MBOX HTML presentation. MBOX remains first-message preview, not a mailbox browser.
• Compatibility or migration risk: email HTML no longer loads remote tracking images/styles or activates external hyperlinks; body RTF forces external resources and links off regardless of host opt-ins. Full preset already registers Word/RTF; selective installs must add the documented Word renderer/RTF capability for rich RTF. No new runtime dependency. S/MIME/IRM decryption, signature verification, OLE activation and complete Outlook contacts/tasks/calendar behavior are not implemented; no pixel-identical Outlook claim is made.
• Rollback: revert this focused commit; no data or configuration migration is required.

Checklist

• I added or updated focused automated coverage, or explained why it is not needed.
• I updated user-facing documentation or release notes when behavior or API changed, or marked them not applicable.
• I verified offline/private-deployment paths when changing Worker, WASM, fonts, vendor assets, or URLs. Local inline-image isolation is covered; no new deployment assets are introduced.
• I did not commit secrets, customer files, private samples, generated caches, or unrelated changes.