fix(mail): enforce end-to-end timeout for SOCKS5 IMAP dial

Use context-based SOCKS dialing and bounded TLS handshake so proxy negotiation and handshake cannot hang indefinitely, with regression tests for both paths.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

internal/mail/imap_test.go

@@ -3,6 +3,7 @@ package mail
 import (
 	"context"
 	"errors"
+	"io"
 	"net"
 	"strings"
 	"testing"
@@ -79,29 +80,83 @@ func TestDialTLSViaSOCKS5_RejectsNonSocks5Scheme(t *testing.T) {
 	}
 }
 
-type errDialer struct{}
+type fakeContextDialer struct{}
 
-func (errDialer) Dial(network, address string) (net.Conn, error) {
-	return nil, errors.New("stop")
+func (fakeContextDialer) Dial(network, address string) (net.Conn, error) {
+	return nil, errors.New("used dial")
 }
 
-func TestDialTLSViaSOCKS5_UsesTimeoutForwardDialer(t *testing.T) {
+func (fakeContextDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	if _, ok := ctx.Deadline(); !ok {
+		return nil, errors.New("missing deadline")
+	}
+	return nil, errors.New("used dialcontext")
+}
+
+func TestDialTLSViaSOCKS5_UsesDialContextWithTimeout(t *testing.T) {
 	orig := socks5DialerFactory
 	t.Cleanup(func() { socks5DialerFactory = orig })
 
 	socks5DialerFactory = func(network, address string, auth *proxy.Auth, forward proxy.Dialer) (proxy.Dialer, error) {
-		td, ok := forward.(timeoutDialer)
-		if !ok {
-			t.Fatalf("expected timeoutDialer, got %T", forward)
+		if _, ok := forward.(proxy.ContextDialer); !ok {
+			t.Fatalf("expected ContextDialer, got %T", forward)
 		}
-		if td.timeout != 30*time.Second {
-			t.Fatalf("expected timeout 30s, got %s", td.timeout)
-		}
-		return errDialer{}, nil
+		return fakeContextDialer{}, nil
 	}
 
 	_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
-	if err == nil || !strings.Contains(err.Error(), "proxy dial: stop") {
-		t.Fatalf("expected proxy dial stop error, got %v", err)
+	if err == nil || !strings.Contains(err.Error(), "proxy dial: used dialcontext") {
+		t.Fatalf("expected DialContext path, got %v", err)
+	}
+}
+
+type trackingConn struct {
+	deadline time.Time
+}
+
+func (c *trackingConn) Read(b []byte) (int, error)  { return 0, io.EOF }
+func (c *trackingConn) Write(b []byte) (int, error) { return 0, io.EOF }
+func (c *trackingConn) Close() error                { return nil }
+func (c *trackingConn) LocalAddr() net.Addr         { return dummyAddr("local") }
+func (c *trackingConn) RemoteAddr() net.Addr        { return dummyAddr("remote") }
+func (c *trackingConn) SetDeadline(t time.Time) error {
+	c.deadline = t
+	return nil
+}
+func (c *trackingConn) SetReadDeadline(t time.Time) error  { return nil }
+func (c *trackingConn) SetWriteDeadline(t time.Time) error { return nil }
+
+type dummyAddr string
+
+func (a dummyAddr) Network() string { return "tcp" }
+func (a dummyAddr) String() string  { return string(a) }
+
+type contextConnDialer struct {
+	conn *trackingConn
+}
+
+func (d contextConnDialer) Dial(network, address string) (net.Conn, error) {
+	return nil, errors.New("used dial")
+}
+
+func (d contextConnDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	return d.conn, nil
+}
+
+func TestDialTLSViaSOCKS5_SetsDeadlineForTLSHandshake(t *testing.T) {
+	orig := socks5DialerFactory
+	t.Cleanup(func() { socks5DialerFactory = orig })
+
+	conn := &trackingConn{}
+	socks5DialerFactory = func(network, address string, auth *proxy.Auth, forward proxy.Dialer) (proxy.Dialer, error) {
+		return contextConnDialer{conn: conn}, nil
+	}
+
+	_, err := dialTLSViaSOCKS5("imap.example.com:993", "socks5://127.0.0.1:1080", nil)
+	if err == nil || !strings.Contains(err.Error(), "tls handshake") {
+		t.Fatalf("expected tls handshake error, got %v", err)
+	}
+	if conn.deadline.IsZero() {
+		t.Fatal("expected TLS handshake deadline to be set")
 	}
 }