EMAIL-WP-0005-T02: add GreenMail test harness

Adds tests/harness/docker-compose.yml running GreenMail 2.1.12 (digest-pinned)
with SMTP 3025, IMAP 3143 and the API bound to 127.0.0.1 only, plus a
config/harness-imap.yml scanner profile and harness README. Auth is disabled
and no users are declared, so a mailbox is created on first login and per-test
users need no provisioning.

GreenMail standalone offers no STARTTLS, only plaintext or implicit TLS, while
SMTPProvider hardcoded starttls() -- so no send could reach it. SMTPProvider
now takes a security mode via EMAIL_CONNECT_SMTP_SECURITY, defaulting to
starttls. plaintext is refused for any non-loopback host, and hostnames are
never resolved to decide that, so a misconfigured deployment fails at startup
rather than sending credentials in the clear. Trusting GreenMail's self-signed
cert was rejected as the wider risk; see DECISIONS.md.

Verified end to end against the live harness: SMTPProvider.send -> GreenMail ->
ImapMailboxSource, and the documented scan-mailbox CLI. Suite: 52 passed with
the harness down.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_transactional.py

@@ -2,8 +2,11 @@ import io
 import json
 import smtplib
 
+import pytest
+
 from email_connect.transactional import (
     ProviderError,
+    SMTPProvider,
     SQLiteDeliveryStore,
     TransactionalApplication,
 )
@@ -276,3 +279,69 @@ def test_mailbox_evidence_is_not_authorization(tmp_path):
     assert accepted["evidence_ceiling"] == "provider_accepted"
     # Ceiling is explicit; user-engine must not elevate this to authz.
     assert "authorized" not in accepted
+
+
+class RecordingSMTP:
+    """Minimal smtplib.SMTP stand-in that records the handshake it was given."""
+
+    instances = []
+
+    def __init__(self, host, port, timeout=None):
+        self.host, self.port, self.timeout = host, port, timeout
+        self.starttls_calls = 0
+        self.logins = []
+        self.sent = []
+        RecordingSMTP.instances.append(self)
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+    def starttls(self):
+        self.starttls_calls += 1
+
+    def login(self, username, password):
+        self.logins.append((username, password))
+
+    def send_message(self, message):
+        self.sent.append(message)
+
+
+def test_smtp_provider_defaults_to_starttls(monkeypatch):
+    monkeypatch.setattr(smtplib, "SMTP", RecordingSMTP)
+    RecordingSMTP.instances = []
+    provider = SMTPProvider("smtp.example.com", 587, "user", "pass", "noreply@example.com")
+
+    assert provider.security == "starttls"
+    provider.send("person@example.test", "Subject", "body")
+    assert RecordingSMTP.instances[0].starttls_calls == 1
+
+
+def test_plaintext_security_skips_starttls_on_loopback(monkeypatch):
+    monkeypatch.setattr(smtplib, "SMTP", RecordingSMTP)
+    RecordingSMTP.instances = []
+    provider = SMTPProvider("127.0.0.1", 3025, "user", "pass", "noreply@example.com", security="plaintext")
+
+    provider.send("person@example.test", "Subject", "body")
+    smtp = RecordingSMTP.instances[0]
+    assert smtp.starttls_calls == 0
+    assert smtp.logins == [("user", "pass")]
+    assert len(smtp.sent) == 1
+
+
+@pytest.mark.parametrize("host", ["127.0.0.1", "127.0.1.1", "::1", "[::1]", "localhost", "LOCALHOST"])
+def test_plaintext_security_is_allowed_for_loopback_hosts(host):
+    assert SMTPProvider(host, 3025, "user", "pass", "noreply@example.com", security="plaintext")
+
+
+@pytest.mark.parametrize("host", ["smtp.example.com", "10.0.0.5", "::ffff:10.0.0.5", "", "localhost.example.com"])
+def test_plaintext_security_is_refused_for_non_loopback_hosts(host):
+    with pytest.raises(ValueError, match="loopback"):
+        SMTPProvider(host, 3025, "user", "pass", "noreply@example.com", security="plaintext")
+
+
+def test_unsupported_security_mode_is_refused():
+    with pytest.raises(ValueError, match="security mode"):
+        SMTPProvider("127.0.0.1", 3025, "user", "pass", "noreply@example.com", security="none")