feat: add OAuth2 (XOAUTH2) authentication for IMAP

[sebykrueger]

Summary

• Adds Google XOAUTH2 as an alternative to App Password authentication for IMAP — useful for Workspace tenants that disable App Passwords and for users who prefer revocable OAuth grants.
• Introduces a nested imap.auth block with a discriminator field (type: password|xoauth2); existing password-only configs validate and run unchanged via implicit fallback.
• New internal/imap/oauth package implements the Google provider, RFC 8252 loopback flow with PKCE S256, and a SASL XOAUTH2 client (the emersion/go-sasl library only ships OAUTHBEARER, which Microsoft 365 doesn't accept over IMAP — so XOAUTH2 keeps the door open for the M365 follow-up).
• --oauth-login runs the device-side bootstrap on a host with a browser, then the daemon runs fully headless using a refresh token from <dirname(database.path)>/secrets.json or the IMAP_OAUTH_REFRESH_TOKEN env override.
• New parse_dmarc_imap_auth_required Prometheus gauge fires on terminal auth errors (invalid_grant, 4xx) so operators can alert when re-auth is needed.

Why loopback flow, not device flow?

The device authorization grant (RFC 8628) was the first design — it works on truly headless servers. But Google does not permit https://mail.google.com/ in the device-flow scope allowlist, so it's structurally unusable for Gmail IMAP. Loopback flow is the standard recommendation (RFC 8252 §3.1.1) for native/CLI tools — rclone, mbsync, mutt_oauth2.py, and gmailctl all use the same pattern.

For Docker users this means: run --oauth-login once on a host with a browser, paste the printed IMAP_OAUTH_REFRESH_TOKEN=... line into a .env file, then the container is fully headless. The compose.yml is updated to include env_file: [.env, required: false] so existing App Password users are unaffected.

Provider scope

Google only in v1. The provider abstraction is structured so Microsoft 365 / Entra ID is essentially a one-file addition (different OAuth endpoints, scope = https://outlook.office.com/IMAP.AccessAsUser.All offline_access, same XOAUTH2 SASL mechanism).

Test plan

• go test ./... — config backwards-compat (password-only validates), XOAUTH2 validation (missing client_id/secret rejected, unknown provider rejected), secrets file round-trip with 0600 permissions and env override precedence, terminal vs transient OAuth error classification, PKCE verifier/challenge match, XOAUTH2 wire format
• go vet ./... clean
• go build ./... clean (CGO and non-CGO)
• End-to-end manual test: built host binary, created Desktop app OAuth client in Google Cloud, ran --oauth-login (browser opened, consent succeeded, refresh token printed), set IMAP_OAUTH_REFRESH_TOKEN in .env, ran docker compose up -d, daemon connected to imap.gmail.com:993 and authenticated successfully via XOAUTH2
• Verified existing password configs still validate and would still work (no schema-breaking changes; new auth block defaults to absent → password mode)