Add custom auth, connection testing, preconfig_only, and security fixes

Major form improvements:
- Custom SMTP/Sieve credentials (separate username/password per protocol)
- Connection testing on save (IMAP, SMTP, Sieve) with localized errors
- preconfig_only mode to restrict domains to preconfigured entries
- Form POST value preservation on save errors (auth selects, passwords)
- Smart host placeholders (SMTP/Sieve default to IMAP host)

Security and bug:
- Fix password re-encryption bug (was comparing raw vs encrypted values)
- Fix XSS: escape label output in special folders form
- Fix parse_url() return value not checked for false
- Fix decrypt() failures not handled (fallback to empty string)
- Sanitize log output (remove raw POST data from log messages)
- Replace weak == comparisons with strict === (PHP and JS)

SQL changes:
- Consolidate 4 migrations (2026021000-03) into single 2026021000
- Remove now unused notify_sound_url column
- Add smtp_username, smtp_password, sieve_username, sieve_password columns

lib/IdentSwitchChecker.php

@@ -31,9 +31,9 @@ class IdentSwitchChecker
 		$identities = $this->get_checkable_identities($rc);
 
 		// Exclude the currently active secondary identity (RC already checks it)
-		$activeIid = $_SESSION['iid' . ident_switch::MY_POSTFIX] ?? -1;
+		$activeIid = (int)($_SESSION['iid' . ident_switch::MY_POSTFIX] ?? -1);
 		$identities = array_values(array_filter($identities, function ($id) use ($activeIid) {
-			return $id['iid'] != $activeIid;
+			return (int)$id['iid'] !== $activeIid;
 		}));
 
 		// When impersonating, also check the primary account
@@ -132,6 +132,10 @@ class IdentSwitchChecker
 
 		$username = $identity['username'] ?: $identity['email'];
 		$password = $rc->decrypt($identity['password']);
+		if ($password === false) {
+			ident_switch::write_log("Failed to decrypt password for identity {$identity['iid']}");
+			return $previousCount;
+		}
 
 		$result = $imap->connect($host, $username, $password, [
 			'port' => $port,