TW-4880: route Nylas-managed grants through per-grant send endpoint

[qasim-nylas]

Summary

• Air and the CLI both routed Nylas-provider grants through the domain-based /v3/domains/{domain}/messages/send endpoint, which is a non-archiving relay and injects a developer-account banner. Switch both to /v3/grants/{id}/messages/send with From auto-populated, so messages land in the sender's Sent folder the same way Google/Microsoft sends do.
• Pin Air's compose payload to the page-rendered grant_id (via a new data-default-grant-id body attr) so the visible "from" account matches what the backend uses, regardless of default-grant resolution drift.
• Replace the demo-stub refreshEmails() in settings.js with a real EmailListManager.loadEmails(currentFolder) call so Air's refresh button actually pulls new mail.

Why

Two user-reported bugs:

1. nylas air wasn't pulling new emails when they arrived — the refresh handler was a placebo.
2. Sending from a Nylas-provider grant complained about "from address" and (when it succeeded via the transactional fallback) never appeared in the Sent folder. Verified against the API: only the per-grant endpoint archives.

Test plan

• make ci-full — all steps pass (fmt, vet, lint, unit, race, security, vuln, CLI regression, agent integration, Air integration)
• New unit tests cover Air handler routing (request grant wins over default, Nylas auto-populates From, unknown grant rejected with 400, caller-supplied From preserved)
• New CLI unit tests cover sendMessageForGrant for managed and standard providers
• New Playwright spec asserts body exposes data-default-grant-id and the send request payload includes it
• Live verification: sent from a Nylas-managed grant (info@qasim.nylas.email) — message ID b09369cf-bfdf-491b-8b0f-abccf5eb9031 (UUID format = per-grant endpoint), confirmed in Sent folder via API
• Live verification: sent from a Google grant — still works, no banner, no From rewrite

Linked ticket

TW-4880 (Epic: TW-4638 Nylas CLI)