Select a whole folder, not just the rows that are loaded

The header checkbox selected the loaded page. On a folder of ten thousand
that is fifty of them, and the only way to act on the rest was to scroll
until they loaded and tick again.

A line now offers the rest by name once the page is selected, and taking
it is a separate press. A checkbox that silently meant ten thousand when
the screen shows fifty would be the worst of both, so each option says
what it actually covers.

The wider selection is a query rather than a list of ids. What it reaches
is resolved from the server when an action runs, walked a page at a time,
because a folder holds far more than one call returns and Email/set
refuses more ids than maxObjectsInSet in one go -- which setEmails already
chunks for. It resolves uncollapsed, unlike the list: "everything in this
folder" means every message rather than one per thread, and expanding
threads the way a click does is impossible here anyway, since that walks
loaded Email objects and these are the ones that were never loaded.

Two things this exposed.

Undo is now withheld once a move reaches messages that were never loaded.
It restores the folders each message was in, taken from what the browser
holds, and for an unloaded message that is nothing -- so the undo would
have written an empty mailboxIds and left the message in no folder at all,
which is worse than the move it was undoing. move() and archiveByDate()
both did this; both now drop the offer rather than restore something
wrong.

And an action consumes the wider selection. The optimistic paths cleared
the selected ids but not the flag, so the next action would have silently
reached the whole folder again.

FEATURES.md

@@ -152,6 +152,26 @@ more attempt. A drag that is merely more sideways than not stays a scroll.
   message count; it can be switched off to list messages individually.
 - **Multi-select** with `x`, shift-click for ranges, `Ctrl/Cmd+A` for all, and
   a long press on a touchscreen.
+- **Select the whole folder**, not just the rows that happen to be loaded. The
+  header checkbox takes the loaded page, which on a folder of ten thousand is
+  fifty of them; a line then offers the other 9,950 by name, and taking it is a
+  separate press. A checkbox that silently meant ten thousand when the screen
+  shows fifty would be the worst of both, so each option says what it actually
+  covers.
+
+  The wider selection is a *query*, not a list of ids: what it reaches is
+  resolved from the server when an action runs, walked a page at a time,
+  because a folder holds far more than one call returns. It is resolved
+  **uncollapsed** — "everything in this folder" means every message rather than
+  one per thread. And it is consumed by the action that used it, so the next
+  action does not silently reach the whole folder again.
+
+  **Undo is withheld once the selection reaches messages that were never
+  loaded.** Undo restores the folders each message was in, which can only be
+  known for messages the browser holds; built from the others it would write an
+  empty set of folders and leave the message in none at all. Withholding the
+  offer is better than restoring something wrong, and the toast simply does not
+  carry it.
 - **Drag and drop** onto any folder in the tree, moving the selection or the
   row under the cursor.
 - **Context menu** on any row: reply, forward, archive, delete, spam, read/unread,