type="email" does not validate RFC 2822 address lists

This one is a bit of a doozy. A summary of the changes:

- Session has grown storage for attachments which have been uploaded but
  not yet sent.
- The list of attachments on a message is refcounted so that we can
  clean up the temporary files only after it's done with - i.e. after
  copying to Sent and after all of the SMTP attempts are done.
- Abandoned attachments are cleared out on process shutdown.

Future work:
- Add a limit to the maximum number of pending attachments the user can
  have in the session.
- Periodically clean out abandoned attachments?

This patch contains a whole lot of layout improvements for the alps
theme, mainly replacing the table soup with flexbox and CSS grids, and
fixing up a number of loose ends. This gives us a lot more flexibility
over how the page is laid out. I also cleaned up a lot of other
low-hanging fruit in the layout & styles.

This causes the mailbox to automatically reload the page every 60
seconds, without JavaScript.

This also updates the base template data to include the full URL, and
replaces the earlier "Path" field with a pre-split array of path
components, which is more immediately useful to most templates given the
limitations of string munging with text/template primitives.