feat: Mimecast multi-tenant held mail viewer

- migration 062: mimecast_tenants table (company_id, client_id/secret, account_code)
- Seed Wulf (CUSA13A95) + Seubert (CUSA96A181) tenants
- MimecastClient.getHeldMessages(): full pagination via meta.pagination.next cursor
  (API always returns 10/page regardless of pageSize param, totalCount in meta)
- getMimecastClientForTenant() factory for per-tenant instantiation
- GET /api/mimecast/held?tenantId=&recipient= — fetches all tenants in parallel,
  merges + sorts by date, returns per-tenant counts + combined messages[]
- Held Mail tab on /admin/sync/mimecast (on-demand load, recipient filter,
  tenant badges, policy filter dropdown, DMARC/impersonation highlighted red)

migrations/061_create_recurring_revenue_views.sql

@@ -0,0 +1,49 @@
+-- Views filtering all core Autotask data to CompanyCategory ID 1 (Recurring Revenue Customer)
+
+-- Base: recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_companies AS
+SELECT *
+FROM companies
+WHERE company_category_id = 1
+  AND is_active = true;
+
+-- Tickets for recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_tickets AS
+SELECT t.*
+FROM tickets t
+INNER JOIN v_mrr_companies c ON c.id = t.company_id
+WHERE t.is_deleted = false;
+
+-- Contacts for recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_contacts AS
+SELECT ct.*
+FROM contacts ct
+INNER JOIN v_mrr_companies c ON c.id = ct.company_id
+WHERE ct.is_deleted = false;
+
+-- Contracts for recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_contracts AS
+SELECT cn.*
+FROM contracts cn
+INNER JOIN v_mrr_companies c ON c.id = cn.company_id
+WHERE cn.is_deleted = false;
+
+-- Configuration items for recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_configuration_items AS
+SELECT ci.*
+FROM configuration_items ci
+INNER JOIN v_mrr_companies c ON c.id = ci.company_id
+WHERE ci.is_deleted = false;
+
+-- Time entries for recurring revenue companies (via ticket)
+CREATE OR REPLACE VIEW v_mrr_time_entries AS
+SELECT te.*
+FROM time_entries te
+INNER JOIN v_mrr_tickets t ON t.id = te.ticket_id;
+
+-- Billing items for recurring revenue companies
+CREATE OR REPLACE VIEW v_mrr_billing_items AS
+SELECT bi.*
+FROM billing_items bi
+INNER JOIN v_mrr_companies c ON c.id = bi.company_id
+WHERE bi.is_deleted = false;

migrations/062_create_mimecast_tenants.sql

@@ -0,0 +1,19 @@
+-- Migration 062: Mimecast multi-tenant credentials
+-- Stores per-client Mimecast API credentials for held mail and other per-tenant queries
+
+CREATE TABLE IF NOT EXISTS mimecast_tenants (
+  id                  SERIAL PRIMARY KEY,
+  company_id          BIGINT REFERENCES companies(id) ON DELETE SET NULL,
+  account_code        VARCHAR(50),
+  account_name        VARCHAR(255),
+  client_id           VARCHAR(255) NOT NULL,
+  client_secret       VARCHAR(255) NOT NULL,
+  base_url            VARCHAR(255) DEFAULT 'https://api.services.mimecast.com',
+  enabled             BOOLEAN DEFAULT true,
+  notes               TEXT,
+  created_at          TIMESTAMP WITHOUT TIME ZONE DEFAULT NOW(),
+  updated_at          TIMESTAMP WITHOUT TIME ZONE DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_mimecast_tenants_company ON mimecast_tenants(company_id);
+CREATE INDEX IF NOT EXISTS idx_mimecast_tenants_enabled ON mimecast_tenants(enabled);