feat: held mail release button + per-tenant fetch

- Add releaseHeldMessage() to MimecastClient (POST /api/gateway/hold-release)
- Add POST /api/mimecast/held/release route
- HeldMailTab: tenant selector before load (defaults to Wulf), only fetches selected tenant
- Release button per row with spinner + optimistic removal on success
- Error shown inline under Release button if release fails

lib/services/mimecast-client.ts

@@ -526,6 +526,22 @@ export class MimecastClient {
     return { messages: all, totalCount };
   }
 
+  /**
+   * POST /api/gateway/hold-release
+   * Releases a held message by ID. Returns true if released successfully.
+   */
+  async releaseHeldMessage(id: string): Promise<{ released: boolean; error?: string }> {
+    try {
+      const result = await this.request<any>('POST', '/api/gateway/hold-release', {
+        data: [{ id, action: 'release' }],
+      });
+      const row = result?.data?.[0];
+      return { released: row?.release === true };
+    } catch (err: any) {
+      return { released: false, error: err.message };
+    }
+  }
+
   // ── Account ────────────────────────────────────────────────────────────────
 
   /**