Expand WEB.DE read-only integration and IMAP regression coverage

[dermatthes]

WEB.DE IMAP access is now enabled. The existing TLS/authentication check passes on rerun: https://github.com/phore/phore-mailclient/actions/runs/34531131329.

This expands the provider check to read-only INBOX selection, UID search, bounded MIME reads of the three newest messages, cursor pagination, per-action Seen suppression and unchanged persistent flags. A transport guard rejects writes; attachments remain lazy and logs contain only fixed check labels. Empty inboxes explicitly skip message-dependent checks. No personal mail data is uploaded as artifacts.

Normal CI runs the same probe against seeded disposable Dovecot, with additional attachment byte-limit and failed-APPEND flag tests. Unit coverage adds invalid limits, malformed/wrong-folder cursors, protocol-controlled flags and empty-provider handling. The existing cursor fixture is isolated from messages added by other tests.

The separate secret-backed workflow runs on relevant changes on main and this exact branch, or manual dispatch; it does not use pull_request_target. Concurrent mailbox deletions or flag changes can fail provider assertions.

Validation at 00758fd7944c46438ac30236fe9b2101453d3f11:

• 28/28 tests passed (19 unit, 9 Dovecot integration), plus Composer validation and PHP syntax checks: https://github.com/phore/phore-mailclient/actions/runs/34533382217
• Pull-request CI also passed: https://github.com/phore/phore-mailclient/actions/runs/34533401973
• Live WEB.DE passed all checks, including actual message reads (no empty-mailbox skips), cursor pagination and unchanged flags: https://github.com/phore/phore-mailclient/actions/runs/34533382268

No production-code or Webklex upstream changes were required.