Add real IMAP4rev1/POP3 implementations, DKIM/DMARC/SPF, SpamAssassin delivery hook

IMAP (RFC 3501): LOGIN through UID, previously all stubs except
CAPABILITY/LOGOUT/a partial APPEND. Multi-folder support with per-folder
UID/flag indexing (new MailFolder class, backed by .uidvalidity/.uidnext/
.imapindex sidecar files), ENVELOPE support (new MessageHeaders class:
header parsing, address-list parsing, IMAP quoting), and shared
cursor-based argument parsing (new IMAPArgs class: sequence sets, flag
lists, dates, folder-name normalization, and path-traversal protection
via isValidFolderName - a bare ".." folder name would otherwise resolve
into a sibling user's mailbox directory).

POP3 (RFC 1939): USER through QUIT, previously only CAPA. Added UIDL.
POP3 handlers use cursor-based parsing throughout rather than indexed
access - ZString's copy constructor doesn't copy its `list` field, and
POP3's dispatch passes the request by value, so indexed access into a
copy was silently reading nothing.

SMTP: DMARC evaluation added to the DATA-terminator path (DKIM
verification + alignment/policy, Authentication-Results header,
conditional rejection matching RFC 7489 6.3's p=reject + sampled pct=).
AUTH LOGIN now handles RFC 4954's optional inline initial response
(e.g. Python smtplib's "AUTH LOGIN <base64>" in one line) instead of
only the exact three-line form. Outbound relay now forces IPv4
(AF_INET) instead of AF_UNSPEC - this server's IPv4 has a correct PTR
record and SPF coverage, its IPv6 doesn't, and Gmail was rejecting
outbound mail with 550 5.7.25 as a result.

Delivery pipeline: local delivery now runs the message through
SpamAssassin (new SpamAssassinFilter class, speaking spamd's PROCESS
protocol directly over a raw socket - fails open/delivers unscanned if
spamd is unreachable) instead of a plain hardlink, since scanning can
tag/modify content.

BARANTMailConfig: extracted config loading into its own class.

compile: (see individual file changes - build script adjustments to
match the above).

Deliberately excluded from this commit: barantmail.log/
barantmail-service.log (operational logs, not source - barantmail.log
in particular was the runaway 55GB/12.9GB file from a busy-loop bug
fixed separately in ServerCore) and barantmail.cfg (this server's own
live deployment config, matching how APIServer's equivalent
config also stays untracked).

__SMTP_MAIL.cpp

@@ -1,4 +1,6 @@
 #include "__SMTP_MAIL.h"
+#include "SMTPServer.h"
+#include "SPFChecker.h"
 
 namespace mail {
 
@@ -8,11 +10,43 @@ namespace mail {
 	 request[1].skipWhitespace();
 	 if(request[1].ifNext("<")) {
 	    session.from = request[1].getTokenExclude(">");
-	    if(session.authState = USER_KNOWN) {
-	       session.out << "250 OK" << CRLF;
-	       session.recipientList.clear();
-	       session.state = MAIL;
-	    }
+	    // Deliberately unconditional - not gated on authState. A
+	    // receiving MX server accepts MAIL FROM addressed to its own
+	    // local mailboxes from anyone; sending MTAs never AUTH to a
+	    // destination domain, only to their own outbound smarthost.
+	    // Authentication only needs to gate relaying to a NON-local
+	    // recipient, which __SMTP_RCPT.cpp already does via
+	    // session.relay. This used to be
+	    // `if(session.authState = USER_KNOWN)` - an assignment, not
+	    // a comparison - which accidentally produced this same
+	    // "always accept" behavior; a literal `==` fix would instead
+	    // have started rejecting all normal inbound mail.
+	    session.out << "250 OK" << CRLF;
+	    session.recipientList.clear();
+	    session.state = MAIL;
+
+	    // RFC 7208 2.4: the identity to check is the MAIL FROM
+	    // address's own domain, or - for the null reverse-path <>
+	    // bounce messages use, which has no domain of its own - the
+	    // HELO/EHLO domain instead. Computed here (not deferred to
+	    // DATA) since MAIL FROM is where the RFC actually anchors the
+	    // check; DATA just reuses the result via session.spfHeader
+	    // rather than re-running the DNS lookups a second time. This
+	    // does block this connection's EPoll worker thread for
+	    // however long the SPF DNS lookups take (matching
+	    // SendMail::lookupMX()'s own res_query() calls, which are
+	    // synchronous the same way) - acceptable for a well-behaved
+	    // sender domain, not for a slow/hostile one, same tradeoff
+	    // already accepted elsewhere in this codebase rather than a
+	    // new one introduced here.
+	    std::string fromStr = session.from.str();
+	    size_t at = fromStr.find_last_of('@');
+	    std::string spfDomain = (at == std::string::npos) ? session.clientDomainName.str() : fromStr.substr(at + 1);
+	    std::string clientIP = session.ipAddress.getClientAddress();
+	    session.spfDomain = spfDomain;
+	    session.spfResult = SPFChecker::check(spfDomain, clientIP);
+	    session.spfHeader = SPFChecker::receivedSPFHeader(session.spfResult, spfDomain, clientIP,
+	                                                       session.clientDomainName.str(), server.hostName);
 	 } else
 	   session.out << "550 Usage: MAIL FROM:<email-address>" << CRLF;
       } else
@@ -20,11 +54,5 @@ namespace mail {
       return 1;
    }
 
-//   std::string domainOnly(std::string email) {
-//      coreutils::ZString split(email);
-//      split.split("@");
-//      return split[1].str();
-//   }
-
 }