Multi-recipient send + quoted-body reply

[iduartgomez]

Feature request

Two related gaps surfaced while scoping threading/contacts work.

A. Multi-recipient send — currently MISSING

DecryptedMessage.to is already Vec<MlKemEncapsKey> (ui/src/inbox.rs:528), but every layer above is single-recipient:

• app.rs:382-390 builds the message with exactly one recipient (to: vec![MlKemEncapsKey::from_key(&recipient_ek)]).
• start_sending (ui/src/inbox.rs:535-544) takes a single recipient_ek + single recipient_ml_dsa_vk; no loop.
• Compose To-field (app.rs:2700-2722) reads one String, does one address_book::lookup, no comma/semicolon split.
• AFT: assign_token burns one token per start_sending call (ui/src/inbox.rs:557-566). N recipients = N inboxes = N token burns.

Minimal change: parse the To field into a list of aliases, resolve each, call send_message once per resolved recipient (each burns its own AFT token against that recipient's inbox). Decide UX for partial failure (one recipient out of tokens / unreachable).

B. Reply — currently PARTIAL

Reply buttons already exist on inbox (app.rs:2444-2448, testid FM_REPLY) and archive (app.rs:2111-2115) detail views. They call open_compose_with(reply_to, "Re: <subject>") and correctly prefill To + subject.

Missing: quoted body. open_compose_with (app.rs:1156-1166) hardcodes body: String::new(). A quote_body() helper already exists (app.rs:2061-2063, used by Forward) and ComposePrefill already has a body field (app.rs:1078-1081). Switch the inbox/archive reply call sites from open_compose_with to open_draft with a ComposePrefill that passes quote_body(&content). No new struct needed.

Acceptance

• Compose To accepts multiple recipients; sending delivers to each (one AFT burn per recipient).
• Reply prefills To + "Re: subject" + quoted original body.