Fix: IMAP over SSL connected without TLS; never lose a sent message's copy

v1.3.26's IMAP4_SSL subclass put its create_client ahead of aioimaplib's,
which is where the TLS context is made — so port 993 got plain TCP, the
server waited for a handshake, and every SSL account timed out ("Can't
reach the mail server"). The context is now made in our create_client too,
and a test checks an SSL client really gets one (it fails without the fix).

With IMAP down, a send could still be delivered by SMTP while filing its copy
in Sent failed — the send then counted as done and the copy was lost. The
copy is now kept and filed by file_sent_copy_job, retried (arq Retry) for
about 24 hours, then shown in Sent as usual.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/tests/sync/test_account_health.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import contextlib
 import uuid
 from collections.abc import AsyncIterator
 
@@ -125,3 +126,27 @@ async def test_refused_sign_in_stops_syncing(account_id: uuid.UUID) -> None:
     await health.failed(ProviderAuthError("AUTHENTICATIONFAILED"))
     account = await _account(account_id)
     assert account.state == "auth_failed" and "AUTHENTICATIONFAILED" in account.state_detail
+
+
+async def test_ssl_connections_really_use_tls(monkeypatch) -> None:  # type: ignore[no-untyped-def]
+    """Regression (v1.3.26): our IMAP4_SSL subclass skipped aioimaplib's TLS
+    setup, so port 993 got plain TCP and every account timed out."""
+    import asyncio
+    import ssl
+
+    from app.providers.imap_smtp.provider import _IMAP4, _IMAP4_SSL
+
+    seen: list[object] = []
+    loop = asyncio.get_running_loop()
+
+    async def fake_create_connection(factory, host, port, ssl=None):  # type: ignore[no-untyped-def]
+        seen.append(ssl)
+        raise ConnectionRefusedError
+
+    monkeypatch.setattr(loop, "create_connection", fake_create_connection)
+    for cls in (_IMAP4_SSL, _IMAP4):
+        client = cls(host="imap.example.com", port=993, timeout=1)
+        with contextlib.suppress(ConnectionRefusedError):
+            await client.connect_task
+    assert isinstance(seen[0], ssl.SSLContext)  # SSL: a TLS context
+    assert seen[1] is None  # plain / STARTTLS: none up front