Polish portal UX: toolkit chrome, toasts, and hub empties

Imported from GitHub pull request El-SaMa/oma#122 by @El-SaMa.

---

Summary

• Sticky toolkit tabs under the top bar, one side rail on nested WP/DB/email routes, shared toolkit nav chrome, and hub empty states for support/VPS/webmail.
• Unified mailbox Settings: SSL client card above mailbox controls; /mailbox redirects to client-settings.
• Portal toast provider wired in the client layout for new UI; existing high-CRAP manage surfaces left on window.alert so Fallow new-only stays clean.
• Also unblocks main CI debt: web typecheck fixtures, Vitest @oma/core-api/cpanel/mailbox alias, chainable Supabase mocks, and nested settingsTeam permission keys for next-intl.

Deferred (Fallow CRAP gate on touched files)

• Domains mobile cards, billing table overflow wrappers, calm overview (drop shortcut strip), and toast swaps on existing manage panels.

Test plan

• Website manage: sticky tabs under top bar; nested email/DB show one side rail.
• Mailbox Settings shows SSL box + password/aliases; /mailbox redirects.
• Support/VPS/webmail empty states render with CTAs.
• pnpm --filter web i18n:check passes.
• Fallow PR audit passes.
• Typecheck + unit tests pass in CI.