feat: admin-controlled policy for self-hosted mail server connections

[saiththerobo]

Summary

• Adds three admin-only toggles in Settings → Security → Mail Server Connection Policy:
  • Allow private / local hosts — permits connecting to IMAP/SMTP at private or local addresses (127.x, 192.168.x, 10.x, etc.)
  • Allow insecure TLS — allows skipping TLS certificate verification per account; when off, plain-text (non-TLS) connections are also rejected
  • Allow non-standard ports — permits any IMAP/SMTP port, not just 993/143/465/587
• Policy is enforced at both validation time (account save) and connection time (makeClientCfg, send.js)
• Plain-text IMAP/SMTP is treated as insecure: blocked when "Allow insecure TLS" is off
• Policy errors are surfaced to the UI via sync_error / account_error WebSocket broadcast
• Toggles auto-save on click (no separate Save button), matching existing admin UI patterns
• DNS rebinding protection (resolveForConnection) is preserved even when private hosts are allowed

Changes

• backend/migrations/0013_account_allow_private_host.sql — adds allow_private_hosts, allow_insecure_tls, allow_nonstandard_ports to system_settings
• backend/src/services/connectionPolicy.js — new module; reads all three flags from DB
• backend/src/services/hostValidation.js — all three exports accept { allowPrivate } option
• backend/src/services/imapManager.js — reads policy on every connect; enforces TLS requirement in makeClientCfg
• backend/src/routes/accounts.js — validates host/port against policy on account create/update
• backend/src/routes/admin.js — PATCH /settings persists the three policy flags
• backend/src/routes/send.js — enforces policy for SMTP connections
• frontend/src/components/AdminPanel.jsx — Security tab: policy toggles; account form: conditional skip-TLS toggle and port input mode
• frontend/src/locales/{en,de,es,fr,it,ru,zhCN}.json — i18n keys for new UI strings

Testing

• All existing tests pass (npm test — 165 tests)
• New tests for makeClientCfg TLS enforcement and rejectUnauthorized under all policy combinations
• New allowPrivate option tests for hostValidation functions
• Manually verified against GreenMail (local IMAP server): private host + non-standard port connect when policy allows, fail when revoked
• Plain-text IMAP correctly blocked when "Allow insecure TLS" is off; error surfaces in UI
• IMAPS with self-signed cert: fails when policy off, succeeds when on

CLA

• I have read the CLA and agree to its terms