fix(mail): restore IMAP SOCKS5 dial timeout behavior

Preserve the 30s dial timeout semantics for proxy connections by using a timeout-backed forward dialer, and add a regression test to lock this behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/mail/imap_test.go

@@ -3,10 +3,13 @@ package mail
 import (
 	"context"
 	"errors"
+	"net"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/emersion/go-imap/v2/imapclient"
+	"golang.org/x/net/proxy"
 	"thuanle.me/claw-email-bridge/internal/config"
 )
 
@@ -75,3 +78,30 @@ func TestDialTLSViaSOCKS5_RejectsNonSocks5Scheme(t *testing.T) {
 		t.Fatalf("expected unsupported scheme error, got %v", err)
 	}
 }
+
+type errDialer struct{}
+
+func (errDialer) Dial(network, address string) (net.Conn, error) {
+	return nil, errors.New("stop")
+}
+
+func TestDialTLSViaSOCKS5_UsesTimeoutForwardDialer(t *testing.T) {
+	orig := socks5DialerFactory
+	t.Cleanup(func() { socks5DialerFactory = orig })
+
+	socks5DialerFactory = func(network, address string, auth *proxy.Auth, forward proxy.Dialer) (proxy.Dialer, error) {
+		td, ok := forward.(timeoutDialer)
+		if !ok {
+			t.Fatalf("expected timeoutDialer, got %T", forward)
+		}
+		if td.timeout != 30*time.Second {
+			t.Fatalf("expected timeout 30s, got %s", td.timeout)
+		}
+		return errDialer{}, nil
+	}
+
+	_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
+	if err == nil || !strings.Contains(err.Error(), "proxy dial: stop") {
+		t.Fatalf("expected proxy dial stop error, got %v", err)
+	}
+}