Verify TLS for non-local email servers

[locoholy]

Summary

This tightens the email backend's TLS trust boundary without changing the localhost / Protonmail Bridge workflow.

Problem

The code already treats loopback mail transport specially, but for non-local IMAP/SMTP paths it relies on library defaults that do not verify certificates when no explicit TLS context is passed. That means remote IMAPS, SMTPS, and STARTTLS connections can end up running without certificate validation.

For a daemon whose purpose is to safely expose personal messaging to sandboxed AI tools, that weakens the security model in exactly the wrong place.

What changed

• add a small helper that distinguishes loopback hosts from non-local hosts
• use an explicit TLS context for all IMAP and SMTP SSL / STARTTLS connections
• keep relaxed certificate checks only for loopback hosts (localhost, 127.0.0.1, ::1)
• add regression tests covering IMAPS, IMAP STARTTLS, SMTPS, and SMTP STARTTLS for both loopback and remote hosts

Validation

• python3.11 -m unittest discover -s tests -v
• python3.11 -m compileall messaging_daemon tests