Add real IMAP4rev1/POP3 implementations, DKIM/DMARC/SPF, SpamAssassin delivery hook

IMAP (RFC 3501): LOGIN through UID, previously all stubs except
CAPABILITY/LOGOUT/a partial APPEND. Multi-folder support with per-folder
UID/flag indexing (new MailFolder class, backed by .uidvalidity/.uidnext/
.imapindex sidecar files), ENVELOPE support (new MessageHeaders class:
header parsing, address-list parsing, IMAP quoting), and shared
cursor-based argument parsing (new IMAPArgs class: sequence sets, flag
lists, dates, folder-name normalization, and path-traversal protection
via isValidFolderName - a bare ".." folder name would otherwise resolve
into a sibling user's mailbox directory).

POP3 (RFC 1939): USER through QUIT, previously only CAPA. Added UIDL.
POP3 handlers use cursor-based parsing throughout rather than indexed
access - ZString's copy constructor doesn't copy its `list` field, and
POP3's dispatch passes the request by value, so indexed access into a
copy was silently reading nothing.

SMTP: DMARC evaluation added to the DATA-terminator path (DKIM
verification + alignment/policy, Authentication-Results header,
conditional rejection matching RFC 7489 6.3's p=reject + sampled pct=).
AUTH LOGIN now handles RFC 4954's optional inline initial response
(e.g. Python smtplib's "AUTH LOGIN <base64>" in one line) instead of
only the exact three-line form. Outbound relay now forces IPv4
(AF_INET) instead of AF_UNSPEC - this server's IPv4 has a correct PTR
record and SPF coverage, its IPv6 doesn't, and Gmail was rejecting
outbound mail with 550 5.7.25 as a result.

Delivery pipeline: local delivery now runs the message through
SpamAssassin (new SpamAssassinFilter class, speaking spamd's PROCESS
protocol directly over a raw socket - fails open/delivers unscanned if
spamd is unreachable) instead of a plain hardlink, since scanning can
tag/modify content.

BARANTMailConfig: extracted config loading into its own class.

compile: (see individual file changes - build script adjustments to
match the above).

Deliberately excluded from this commit: barantmail.log/
barantmail-service.log (operational logs, not source - barantmail.log
in particular was the runaway 55GB/12.9GB file from a busy-loop bug
fixed separately in ServerCore) and barantmail.cfg (this server's own
live deployment config, matching how APIServer's equivalent
config also stays untracked).

POP3Session.h

@@ -1,22 +1,56 @@
 #ifndef __POP3Session_h__
 #define __POP3Session_h__
 
+#include "TCPServer.h"
+#include "TCPSession.h"
+#include "MailFolder.h"
+#include <set>
+
+#define CRLF "\r\n"
+
 namespace mail {
 
    class POP3Session : public core::TCPSession {
-      enum AuthState {
-	 USER_UNKNOWN, USER_QUERY, USER_SECRET_QUERY, USER_KNOWN
-      };
-      
-    public:      
+
+    public:
+      POP3Session(core::EPoll &ePoll, core::TCPServer &server)
+	: TCPSession(ePoll, &server, "POP3 Client Session") {}
+
       std::string clientDomainName;
+
+      // RFC 1939 4/7: USER sets the pending username and replies +OK
+      // without checking anything - only PASS actually authenticates
+      // (against MailFileSystem::checkPassword(), shared with SMTP AUTH
+      // and IMAP LOGIN). userName is meaningless until PASS succeeds;
+      // authenticated gates every other command per RFC 1939 3's state
+      // diagram (AUTHORIZATION vs TRANSACTION state).
       std::string userName;
-      std::string password;
-      AuthState authstate = USER_UNKNOWN;      
-      bool relay = false;      
+      bool authenticated = false;
+
+      // Loaded once, right after a successful PASS - POP3 has no
+      // folder concept (RFC 1939 has no SELECT-equivalent), it only
+      // ever operates on Inbox. RFC 1939 3's "maildrop" message
+      // numbering is fixed for the whole session (assigned once here,
+      // not re-derived per command) even if new mail is delivered
+      // mid-session - deletedMarks/QUIT below follow the same
+      // session-frozen-snapshot model.
+      MailFolder mailbox;
+
+      // RFC 1939 3: DELE only MARKS a message deleted - the mark (and
+      // any RSET undoing it) is session-local and has no effect until
+      // QUIT actually commits it by unlinking the marked messages.
+      // Keyed by 1-based POP3 message number (this session's frozen
+      // ordering), not UID.
+      std::set<int> deletedMarks;
+
+      // RFC 1939 4: the server must send a positive greeting before the
+      // client sends anything.
+      void onConnected() override {
+	 out << "+OK POP3 server ready" << CRLF;
+      }
 
    };
-   
+
 }
 
 #endif