BUG: TLS Insecure flag disables all verification without audit logging

[andrinoff]

Describe the bug

The Insecure bool field in config/config.go disables all TLS certificate verification. Issues:

• No distinction between self-signed and compromised/expired certs
• No audit logging when insecure mode is active
• No custom CA certificate support (would eliminate most insecure mode usage)
• No cipher suite control for IMAP/SMTP TLS connections
• No TLS certificate pinning

To reproduce

1. Set insecure: true in account config
2. All TLS verification disabled silently
3. MITM attacks go undetected

Expected behavior

• Add custom CA certificate path config option
• Log warning on every connection when insecure mode active
• Support certificate pinning (TOFU model)
• Allow cipher suite configuration

[floatpanebot]

This has had no activity for 30 days. It will be closed in 14 days unless updated. Comment or remove the stale label to keep it open.

[floatpanebot]

Closing due to inactivity. Reopen if still relevant.