Support SASL-IR for AUTHENTICATE PLAIN - #297

Summary

• Advertise SASL-IR whenever TLS is active, decoupled from OAuth configuration (previously only shown when OAuth was set up).
• AUTHENTICATE PLAIN now accepts the initial response inline on the command line, skipping the + continuation round trip. This matches existing OAUTHBEARER/XOAUTH2 behavior.
• = as the inline argument is treated as an explicit zero-length response, distinct from omitting the argument entirely.
• * cancellation only applies to the continuation-fallback path, not to an inline argument (there's no prompt to cancel).

Closes #296.

Test plan

• go test ./... passes
• New unit tests: TestAuthenticatePlainSASLIRInline, TestAuthenticatePlainSASLIRExplicitEmpty
• Updated capability_test.go to assert SASL-IR gating on TLS, not OAuth
• New end-to-end integration test: TestIMAPServerToClient_AuthenticatePlainInlineIR (real TLS handshake, real DB-backed auth)
• Manually verified against a real Nextcloud Mail client