fix(auth): app passwords now sign in SMTP, IMAP and POP3

The webmail creates app passwords (shown once, stored hashed, with scopes) but
the protocol servers only compared a login against mailboxes.password_hash, so
an app password was always refused with 535 / authentication failed. They exist
because mail clients cannot do a second factor.

- port.MailboxAuth carries the mailbox's app passwords (newest 20) with their
  scopes; the Postgres repository loads them and stamps last_used_at on use
- verifyCredential accepts the mailbox password or an app password that holds
  the scope of the protocol; SMTP, IMAP and POP3 use it. ManageSieve keeps the
  mailbox password only, as no default scope covers it
- a malformed app password hash is skipped instead of failing the login; a
  malformed mailbox hash still surfaces as the server-side error it was

Tests: unit cases for scopes and malformed hashes, the three entry points,
repository tests against Postgres, and an end-to-end test on the real
submission server that fails with 535 without the fix and passes with it.
Full `go test ./...` with TEST_DATABASE_URL, go vet and lang-lint are clean.

services/protocols/internal/infrastructure/postgres/auth_repository.go

@@ -38,5 +38,37 @@ func (r *AuthRepository) FindByAddress(ctx context.Context, address string) (*po
 		return nil, err
 	}
 	rec.ID = id
+
+	// The newest few only: each one costs an Argon2 comparison on a failed login,
+	// so the number considered is bounded.
+	rows, err := r.pool.Query(ctx, `
+		SELECT id, password_hash, scopes
+		FROM app_passwords
+		WHERE mailbox_id = $1
+		ORDER BY created_at DESC
+		LIMIT $2
+	`, id, port.MaxAppPasswordsChecked)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var app port.AppPasswordAuth
+		if err := rows.Scan(&app.ID, &app.Hash, &app.Scopes); err != nil {
+			return nil, err
+		}
+		rec.AppPasswords = append(rec.AppPasswords, app)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
 	return &rec, nil
 }
+
+// RecordAppPasswordUse stamps the moment an app password last signed a client in.
+func (r *AuthRepository) RecordAppPasswordUse(ctx context.Context, id uuid.UUID) error {
+	_, err := r.pool.Exec(ctx, `UPDATE app_passwords SET last_used_at = NOW() WHERE id = $1`, id)
+	return err
+}