EMAIL-WP-0005-T02: add GreenMail test harness

Adds tests/harness/docker-compose.yml running GreenMail 2.1.12 (digest-pinned)
with SMTP 3025, IMAP 3143 and the API bound to 127.0.0.1 only, plus a
config/harness-imap.yml scanner profile and harness README. Auth is disabled
and no users are declared, so a mailbox is created on first login and per-test
users need no provisioning.

GreenMail standalone offers no STARTTLS, only plaintext or implicit TLS, while
SMTPProvider hardcoded starttls() -- so no send could reach it. SMTPProvider
now takes a security mode via EMAIL_CONNECT_SMTP_SECURITY, defaulting to
starttls. plaintext is refused for any non-loopback host, and hostnames are
never resolved to decide that, so a misconfigured deployment fails at startup
rather than sending credentials in the clear. Trusting GreenMail's self-signed
cert was rejected as the wider risk; see DECISIONS.md.

Verified end to end against the live harness: SMTPProvider.send -> GreenMail ->
ImapMailboxSource, and the documented scan-mailbox CLI. Suite: 52 passed with
the harness down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

config/harness-imap.yml

@@ -0,0 +1,46 @@
+# Scanner profile for the local GreenMail test harness (EMAIL-WP-0005-T02).
+#
+# Start the harness first:
+#   docker compose -f tests/harness/docker-compose.yml up -d
+#
+# The harness runs with authentication disabled and creates a mailbox on first
+# login, so these credentials are placeholders that only need to be set:
+#   export EMAIL_CONNECT_IMAP_USER=t01@harness.email-connect.test
+#   export EMAIL_CONNECT_IMAP_PASSWORD=harness
+#
+# Then:
+#   email-connect scan-mailbox --config config/harness-imap.yml --out reports/
+mailbox:
+  id: harness-mailbox
+  protocol: imap
+  host: 127.0.0.1
+  port: 3143
+  tls: false
+  username_env: EMAIL_CONNECT_IMAP_USER
+  password_env: EMAIL_CONNECT_IMAP_PASSWORD
+  folder: INBOX
+
+scan:
+  mode: incremental
+  max_messages_per_run: 5000
+  since: null
+  from: null
+  to: null
+  include_seen: true
+  mark_seen: false
+  store_raw_headers: true
+  store_raw_body: false
+  store_raw_message_ref: true
+
+expected_recipients:
+  path: null
+  csv_column: email
+
+storage:
+  path: .email-connect/harness-state.sqlite
+
+reports:
+  output_dir: reports
+  include_all_evidence: true
+  include_unknown_messages: true
+  timestamp_timezone: UTC