Add real IMAP4rev1/POP3 implementations, DKIM/DMARC/SPF, SpamAssassin delivery hook

IMAP (RFC 3501): LOGIN through UID, previously all stubs except
CAPABILITY/LOGOUT/a partial APPEND. Multi-folder support with per-folder
UID/flag indexing (new MailFolder class, backed by .uidvalidity/.uidnext/
.imapindex sidecar files), ENVELOPE support (new MessageHeaders class:
header parsing, address-list parsing, IMAP quoting), and shared
cursor-based argument parsing (new IMAPArgs class: sequence sets, flag
lists, dates, folder-name normalization, and path-traversal protection
via isValidFolderName - a bare ".." folder name would otherwise resolve
into a sibling user's mailbox directory).

POP3 (RFC 1939): USER through QUIT, previously only CAPA. Added UIDL.
POP3 handlers use cursor-based parsing throughout rather than indexed
access - ZString's copy constructor doesn't copy its `list` field, and
POP3's dispatch passes the request by value, so indexed access into a
copy was silently reading nothing.

SMTP: DMARC evaluation added to the DATA-terminator path (DKIM
verification + alignment/policy, Authentication-Results header,
conditional rejection matching RFC 7489 6.3's p=reject + sampled pct=).
AUTH LOGIN now handles RFC 4954's optional inline initial response
(e.g. Python smtplib's "AUTH LOGIN <base64>" in one line) instead of
only the exact three-line form. Outbound relay now forces IPv4
(AF_INET) instead of AF_UNSPEC - this server's IPv4 has a correct PTR
record and SPF coverage, its IPv6 doesn't, and Gmail was rejecting
outbound mail with 550 5.7.25 as a result.

Delivery pipeline: local delivery now runs the message through
SpamAssassin (new SpamAssassinFilter class, speaking spamd's PROCESS
protocol directly over a raw socket - fails open/delivers unscanned if
spamd is unreachable) instead of a plain hardlink, since scanning can
tag/modify content.

BARANTMailConfig: extracted config loading into its own class.

compile: (see individual file changes - build script adjustments to
match the above).

Deliberately excluded from this commit: barantmail.log/
barantmail-service.log (operational logs, not source - barantmail.log
in particular was the runaway 55GB/12.9GB file from a busy-loop bug
fixed separately in ServerCore) and barantmail.cfg (this server's own
live deployment config, matching how APIServer's equivalent
config also stays untracked).

BARANTMailConfig.h

@@ -0,0 +1,104 @@
+#ifndef __BARANTMailConfig_h__
+#define __BARANTMailConfig_h__
+
+#include "TLSInfo.h"
+#include <string>
+
+namespace coreutils { class JFile; }
+
+namespace mail {
+
+   ///
+   /// Server startup configuration, loaded from a JSON file via
+   /// CoreUtils' JFile - mirrors APIServer's own ApiServerConfig (see
+   /// that class's doc comment for JFile's create-on-missing behavior).
+   ///
+   /// Schema:
+   ///   {
+   ///     "hostName": "mail.example.com",
+   ///     "mailPath": "/var/mail",
+   ///     "smtp":    { "port": 25 },
+   ///     "smtpTLS": { "port": 465 },
+   ///     "imap":    { "port": 993 },
+   ///     "pop3":    { "port": 995 },
+   ///     "tls": {
+   ///       "certificate": "/path/to/fullchain.pem",
+   ///       "key": "/path/to/privkey.pem",
+   ///       "caCertificate": "/path/to/ca.pem"
+   ///     },
+   ///     "dkim": {
+   ///       "domain": "mail.example.com",
+   ///       "selector": "default",
+   ///       "privateKey": "/path/to/dkim_private.pem"
+   ///     }
+   ///   }
+   ///
+   /// "hostName", "mailPath", and "smtp.port" are required - plain port
+   /// 25 is the one listener every deployment needs (an inbound peer
+   /// MTA relaying mail in has no TLS-first negotiation to fall back
+   /// on). "smtpTLS"/"imap"/"pop3" are each independently optional -
+   /// leaving one out just means that listener isn't started, so this
+   /// same file covers a plaintext-only relay just as well as a full
+   /// mail server. The moment any one of those three IS present,
+   /// "tls.certificate" and "tls.key" become required - there is no
+   /// path through this class that hands back a submission/IMAPS/POP3S
+   /// listener request without a real certificate configured for it.
+   /// "dkim" is entirely optional - outbound mail goes out unsigned
+   /// unless all three of its fields are present.
+   ///
+
+   class BARANTMailConfig {
+
+    public:
+
+      BARANTMailConfig(const std::string &path);
+      ~BARANTMailConfig();
+
+      std::string getHostName();
+      std::string getMailPath();
+
+      int getSmtpPort();
+
+      bool hasSmtpTLS();
+      int getSmtpTLSPort();
+
+      bool hasImap();
+      int getImapPort();
+
+      bool hasPop3();
+      int getPop3Port();
+
+      ///
+      /// NULL if none of smtpTLS/imap/pop3 are configured. Owned by
+      /// this BARANTMailConfig, valid for as long as it is - pass
+      /// straight through to a server's tlsInfo parameter, do not
+      /// delete, and don't let this config object go out of scope
+      /// while a server built from this pointer is still running.
+      ///
+
+      core::TLSInfo *getTlsInfo();
+
+      bool hasDkim();
+      std::string getDkimDomain();
+      std::string getDkimSelector();
+      std::string getDkimPrivateKeyPath();
+
+    private:
+
+      coreutils::JFile *file;
+
+      // Owned, persistent storage for the TLSInfo fields below -
+      // TLSInfo's own ZString members are non-owning views, so they
+      // have to point at something that outlives them; pointing them at
+      // temporary std::strings decoded during construction would leave
+      // them dangling the moment this constructor returned.
+      std::string certPath, keyPath, caPath;
+
+      core::TLSInfo tlsInfo;
+      bool hasTls = false;
+
+   };
+
+}
+
+#endif