Add real IMAP4rev1/POP3 implementations, DKIM/DMARC/SPF, SpamAssassin delivery hook

IMAP (RFC 3501): LOGIN through UID, previously all stubs except
CAPABILITY/LOGOUT/a partial APPEND. Multi-folder support with per-folder
UID/flag indexing (new MailFolder class, backed by .uidvalidity/.uidnext/
.imapindex sidecar files), ENVELOPE support (new MessageHeaders class:
header parsing, address-list parsing, IMAP quoting), and shared
cursor-based argument parsing (new IMAPArgs class: sequence sets, flag
lists, dates, folder-name normalization, and path-traversal protection
via isValidFolderName - a bare ".." folder name would otherwise resolve
into a sibling user's mailbox directory).

POP3 (RFC 1939): USER through QUIT, previously only CAPA. Added UIDL.
POP3 handlers use cursor-based parsing throughout rather than indexed
access - ZString's copy constructor doesn't copy its `list` field, and
POP3's dispatch passes the request by value, so indexed access into a
copy was silently reading nothing.

SMTP: DMARC evaluation added to the DATA-terminator path (DKIM
verification + alignment/policy, Authentication-Results header,
conditional rejection matching RFC 7489 6.3's p=reject + sampled pct=).
AUTH LOGIN now handles RFC 4954's optional inline initial response
(e.g. Python smtplib's "AUTH LOGIN <base64>" in one line) instead of
only the exact three-line form. Outbound relay now forces IPv4
(AF_INET) instead of AF_UNSPEC - this server's IPv4 has a correct PTR
record and SPF coverage, its IPv6 doesn't, and Gmail was rejecting
outbound mail with 550 5.7.25 as a result.

Delivery pipeline: local delivery now runs the message through
SpamAssassin (new SpamAssassinFilter class, speaking spamd's PROCESS
protocol directly over a raw socket - fails open/delivers unscanned if
spamd is unreachable) instead of a plain hardlink, since scanning can
tag/modify content.

BARANTMailConfig: extracted config loading into its own class.

compile: (see individual file changes - build script adjustments to
match the above).

Deliberately excluded from this commit: barantmail.log/
barantmail-service.log (operational logs, not source - barantmail.log
in particular was the runaway 55GB/12.9GB file from a busy-loop bug
fixed separately in ServerCore) and barantmail.cfg (this server's own
live deployment config, matching how APIServer's equivalent
config also stays untracked).

IMAPSession.h

@@ -1,26 +1,88 @@
 #ifndef __IMAPSession_h__
 # define __IMAPSession_h__
 
+# include "MailFolder.h"
+# include <functional>
+
 # define CRLF "\r\n"
 
 namespace mail {
-   
+
    class IMAPSession : public core::TCPSession {
 
-    public:      
+    public:
       IMAPSession(core::EPoll &ePoll, core::TCPServer &server)
-	: TCPSession(ePoll, server, "IMAP Client Session") {}
+	: TCPSession(ePoll, &server, "IMAP Client Session") {}
 
       enum State { NOT_AUTHENTICATED, AUTHENTICATED, SELECTED };
 
       std::string clientDomainName;
       std::string userName;
       std::string password;
-      State state = NOT_AUTHENTICATED;      
+      std::string tag;
+      State state = NOT_AUTHENTICATED;
 
+      // Valid only while state == SELECTED - the folder SELECT/EXAMINE
+      // last loaded. readOnly is true for EXAMINE (STORE/EXPUNGE must
+      // be refused), false for SELECT.
+      MailFolder mailbox;
+      std::string selectedFolderName;
+      bool readOnly = false;
+
+      // APPEND's message-body literal is the one place raw bytes (not
+      // command lines) arrive - see TCPSocket::setBlockSize()/
+      // onBlockReceived(), unused anywhere else in this codebase before
+      // now. __IMAP_APPEND sets this to a closure that does the actual
+      // mailbox write (kept out of IMAPSession itself so this class
+      // doesn't need to know about MailFileSystem/MailFolder specifics -
+      // it only knows "a block finished, hand it off"), then calls
+      // setBlockSize(n) and sends the "+ OK" continuation. Cleared
+      // before invoking, so a handler that itself needs another literal
+      // (not currently used by anything) can safely set a new one.
+      std::function<void(coreutils::ZString &)> pendingBlockHandler;
+
+      void onBlockReceived(coreutils::ZString &block) override {
+         if (pendingBlockHandler) {
+            auto handler = pendingBlockHandler;
+            pendingBlockHandler = nullptr;
+            handler(block);
+         }
+      }
+
+      // Used to falsely claim to be Dovecot and advertise a capability
+      // list (LITERAL+/SASL-IR/LOGIN-REFERRALS/ID/ENABLE/IDLE/STARTTLS/
+      // AUTH=PLAIN/AUTH=LOGIN) none of which had a real handler behind
+      // it - see __IMAP_CAPABILITY.cpp's own doc comment for the same
+      // reasoning applied to the CAPABILITY command's response.
       void onConnected() override {
-	 out << "* OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS AUTH=PLAIN AUTH=LOGIN] Dovecot (Ubuntu) ready." << CRLF;	   
-      }      
+	 out << "* OK [CAPABILITY IMAP4rev1] BARANTMail ready." << CRLF;
+      }
+
+    protected:
+
+      // Every IMAP command line is client-tag-prefixed ("a001 LOGIN ...",
+      // RFC 3501 2.2.1) - the tag is an arbitrary string the client
+      // chooses, not a fixed command name, so it can never appear in the
+      // command table CommandList::processRequest() dispatches on
+      // (ServerCore/CommandList.cpp looks up request[0], and for every
+      // real client request[0] is this tag, not the command word).
+      // Confirmed: with no tag-stripping anywhere, request[0] never
+      // matched any registered command, the lookup threw, and the
+      // catch-all in processRequest() silently swallowed it - no IMAP
+      // command from any spec-compliant client ever reached a handler.
+      // Extracting the tag here, before the generic space-delimited
+      // dispatch runs, leaves the command word where the base
+      // TCPSession::protocol()/CommandList expects to find it.
+      void protocol(coreutils::ZString &data) override {
+         if (data.getLength() == 0) {
+            TCPSession::protocol(data);
+            return;
+         }
+         tag = data.getTokenExclude(" ").str();
+         data.skipWhitespace();
+         coreutils::ZString command = data.unparsed();
+         TCPSession::protocol(command);
+      }
       
    };