fix(email): guard round-trip test when IMAP username isn't an email

The round-trip recipient is imap_user (not hardcoded). Some hosts use a
non-email IMAP login — guard against silently sending to a bogus address:
return a clear 'recipient_not_email' error explaining to use a mailbox whose
username is its email, or test connection + manual send instead.

backend/src/routes/adminEmail.js

@@ -232,6 +232,7 @@ router.post('/incoming-config/roundtrip', adminAuth, requirePermission('email.se
     const map = {
       smtp_unconfigured: 'Configure and save the outgoing SMTP settings first.',
       imap_unconfigured: 'Configure and save the incoming IMAP settings first.',
+      recipient_not_email: `The IMAP username (“${result.recipient || ''}”) isn’t an email address, so the round-trip test can’t auto-address itself. Use a mailbox whose username is its email, or send a test email there manually and use “Test connection”.`,
       send_failed: `Could not send the test email${result.error ? `: ${result.error}` : ''}.`,
       not_received: 'The email was sent but did not arrive within 30s — possible delivery delay/greylisting. Check the Received emails tab in a moment.',
     };

backend/src/services/emailIntakeService.js

@@ -138,8 +138,12 @@ async function roundTripTest({ timeoutMs = 30000, intervalMs = 3000 } = {}) {
   if (!c.imap_host || !c.imap_user) return { ok: false, sent: false, reason: 'imap_unconfigured' };
 
   // Recipient = the mailbox we poll. imap_user is the mailbox address in the
-  // typical setup (e.g. rechnungen@…).
+  // typical setup (e.g. rechnungen@…). NOT hardcoded — but some hosts use a
+  // non-email IMAP login, in which case we can't auto-address the test.
   const recipient = c.imap_user;
+  if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(recipient || '')) {
+    return { ok: false, sent: false, reason: 'recipient_not_email', recipient };
+  }
   const token = `ppk-rt-${Date.now()}-${crypto.randomBytes(5).toString('hex')}`;
   const subject = `picpeak round-trip test ${token}`;