fix: require TLS for IMAP auth, close port 143 (CERT-Bund compliance)

- Remove port 143 from mailserver (only expose 993/IMAPS)
- Enable SSL_TYPE=manual with Let's Encrypt certs
- Set DOVECOT_DISABLE_PLAINTEXT_AUTH=yes
- Add pentest_imap_tls config field (defaults to true)

Fixes CERT-Bund report: IMAP PLAIN/LOGIN without TLS on 46.225.100.82:143

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

compliance-core/src/config.rs

@@ -33,6 +33,8 @@ pub struct AgentConfig {
     pub pentest_verification_email: Option<String>,
     pub pentest_imap_host: Option<String>,
     pub pentest_imap_port: Option<u16>,
+    /// Use implicit TLS (IMAPS, port 993) instead of plain IMAP.
+    pub pentest_imap_tls: bool,
     pub pentest_imap_username: Option<String>,
     pub pentest_imap_password: Option<SecretString>,
 }