security: enforce actor-aware Mail profile access

src/govoplan_mail/backend/mailbox_index.py

@@ -36,6 +36,27 @@ class CachedMessagePage:
     stale: bool
 
 
+def clear_mailbox_index(session: Session, *, profile_id: str) -> tuple[int, int]:
+    """Remove every cached mailbox row for a profile in the caller's transaction.
+
+    System profiles can be used by more than one tenant, so invalidation is
+    intentionally profile-wide rather than limited to the tenant making the
+    transport change. Message rows are removed before their folder metadata.
+    """
+
+    deleted_messages = (
+        session.query(MailMailboxMessageIndex)
+        .filter(MailMailboxMessageIndex.profile_id == profile_id)
+        .delete(synchronize_session=False)
+    )
+    deleted_folders = (
+        session.query(MailMailboxFolderIndex)
+        .filter(MailMailboxFolderIndex.profile_id == profile_id)
+        .delete(synchronize_session=False)
+    )
+    return int(deleted_folders or 0), int(deleted_messages or 0)
+
+
 def begin_mailbox_refresh(tenant_id: str, profile_id: str, folder: str) -> bool:
     key = (tenant_id, profile_id, folder)
     with _refresh_lock: