Add an EMAIL connector type: IMAP and SMTP #1344

Problem

The catalog has no way to connect an ordinary mailbox. Searches for "IMAP", "SMTP" and "email" return nothing, and the only mail connectors are provider APIs (Gmail, Microsoft 365/Outlook). Most small businesses in Europe run their mail at IONOS, Strato, GMX, web.de, T-Online, Hetzner, all-inkl, Aruba or on their own Dovecot/Postfix, all of which speak IMAP and SMTP and nothing else.

Proposal

A new connector type EMAIL: IMAP for reading and organising a mailbox, SMTP for sending.

Schema change

• ConnectorType gains the value EMAIL.
• Migration: ALTER TYPE "ConnectorType" ADD VALUE 'EMAIL'; in a new timestamped folder, same shape as 20260927100000_add_odata_connector_type.
• No new tables or columns. Non-secret settings live in connector.config.email (IMAP/SMTP host, port, security, from address, folders); the username and password live in the encrypted authConfig (BASIC_AUTH), with an optional separate SMTP login.

Built-in tools

Like the OData built-ins, every EMAIL connector gets a fixed tool set (prefixed per connector): list folders, search messages, get message, get attachment, set flags (read/unread, flagged), move message, delete (move to Trash, never expunge), save draft (IMAP APPEND to the Drafts folder) and send message (SMTP, with reply threading and a copy in the Sent folder unless the provider files it itself, as Gmail does). Reads are annotated read-only; send is open-world; delete is destructive.

Behaviour

• One IMAP connection per tool call (connect, run, log out), 15 s connect and 60 s socket timeouts; no idle sessions.
• Auth: password / app password only for now, with an extension point for XOAUTH2 later. Microsoft 365 and Outlook.com need OAuth and keep using the existing adapters; Gmail needs an app password.
• Cloud: the outbound SSRF guard applies to the IMAP and SMTP hosts (private, loopback and link-local addresses refused), plaintext connections and self-signed certificates are refused.
• Self-hosted: the same guard with the admin allowlist (SSRF_ALLOWED_HOSTS / Admin → Settings) for an internal mail server, plaintext allowed, and an opt-in "accept self-signed certificate" switch.
• Libraries: imapflow (MIT), mailparser (MIT), the existing nodemailer for SMTP.

Catalog

A catalog adapter intl/imap-smtp ("Email (IMAP/SMTP)", category email) with a provider table (hosts and ports) in its instructions.