fix(auth): app passwords now sign in SMTP, IMAP and POP3

The webmail creates app passwords (shown once, stored hashed, with scopes) but
the protocol servers only compared a login against mailboxes.password_hash, so
an app password was always refused with 535 / authentication failed. They exist
because mail clients cannot do a second factor.

- port.MailboxAuth carries the mailbox's app passwords (newest 20) with their
  scopes; the Postgres repository loads them and stamps last_used_at on use
- verifyCredential accepts the mailbox password or an app password that holds
  the scope of the protocol; SMTP, IMAP and POP3 use it. ManageSieve keeps the
  mailbox password only, as no default scope covers it
- a malformed app password hash is skipped instead of failing the login; a
  malformed mailbox hash still surfaces as the server-side error it was

Tests: unit cases for scopes and malformed hashes, the three entry points,
repository tests against Postgres, and an end-to-end test on the real
submission server that fails with 535 without the fix and passes with it.
Full `go test ./...` with TEST_DATABASE_URL, go vet and lang-lint are clean.

services/protocols/internal/application/port/auth_repository.go

@@ -15,8 +15,29 @@ type MailboxAuth struct {
 	DomainName   string
 	// MaxRecipientsPerHour caps a compromised account's blast radius.
 	MaxRecipientsPerHour int
+	// AppPasswords are the per-client credentials the user generated in the
+	// webmail. Protocol clients cannot answer a second factor, so these are how
+	// a mail client signs in on an account that has one.
+	AppPasswords []AppPasswordAuth
 }
 
+// AppPasswordAuth is one app password as stored: a hash, never the secret.
+type AppPasswordAuth struct {
+	ID     uuid.UUID
+	Hash   string
+	Scopes []string
+}
+
+// AppPasswordUseRecorder is implemented by repositories that can note when an
+// app password was last used. It is optional: a fake in a test need not have it.
+type AppPasswordUseRecorder interface {
+	RecordAppPasswordUse(ctx context.Context, id uuid.UUID) error
+}
+
+// MaxAppPasswordsChecked bounds how many app passwords one login attempt is
+// compared against.
+const MaxAppPasswordsChecked = 20
+
 // AuthRepository resolves a login address to its stored credential.
 type AuthRepository interface {
 	// FindByAddress returns nil, nil (not an error) when no active mailbox