v0.4.13: fix IMAP command injection in folder/uid/search (issue #1) Fixes an IMAP command injection vulnerability (issue #1). Closes #1. - The folder, uid and search values that reach the IMAP client were string-interpolated into IMAP commands and handed to Python's imaplib, which does not sanitize its own arguments. A CR/LF in any of them (reachable from an ordinary %0D%0A in an HTTP query or path parameter) ended the current command and spliced a second, attacker-chosen IMAP command onto the same authenticated connection, including a STORE +FLAGS (\Deleted) + EXPUNGE pair that deletes a whole folder through the read-only message routes. - Every such value is now validated before it reaches imaplib: folder, search and structured search terms (including since/before) reject CR, LF and NUL; uid must be digits and sequence-set punctuation only; and folder names have any embedded " and \ escaped so they cannot break out of the IMAP quoted string. The checks live in imap_client, so both the HTTP API and the MCP server inherit them. - Added an in-process mock IMAP server and an IMAP test suite: the happy path (list, fetch, structured search) plus the injection cases, including the verbatim issue #1 payload driven through the read-only GET route.