Accounts created via REST API fail IMAP authentication (v0.15.5)

## Description Accounts created through the REST API (`POST /api/principal`) with plaintext passwords in the `secrets` field cannot authenticate via IMAP. The same account created through the web admin UI with the same password works immediately. ## Environment - Stalwart v0.15.5 - Directory type: `internal` (RocksDB store) - IMAP client: imapflow v1.2.16 (Node.js) - OS: Ubuntu, Linux 6.x ## Reproduction steps ### 1. Create an account via the REST API: ```bash curl -u "admin:password" -X POST "http://127.0.0.1:8080/api/principal" \ -H "Content-Type: application/json" \ -d '{"type":"individual","name":"test@example.com","emails":["test@example.com"],"secrets":["MyPassword123"],"description":"Test account"}' # Returns: {"data":31} ``` ### 2. Verify the account exists and shows the correct password: ```bash curl -u "admin:password" "http://127.0.0.1:8080/api/principal/test@example.com" # Returns: {"data":{"id":31,"type":"individual","emails":["test@example.com"],"secrets":["MyPassword123"],...}} ``` ### 3. Attempt IMAP login: Via imapflow (Node.js): ```javascript const client = new ImapFlow({ host: '127.0.0.1', port: 993, secure: true, auth: { user: 'test@example.com', pass: 'MyPassword123' }, tls: { rejectUnauthorized: false } }); await client.connect(); // Throws: "Unexpected close" with authenticationFailed: true ``` The IMAP log shows the server closes the connection immediately after receiving the `AUTHENTICATE PLAIN` encoded credentials. ### 4. Recreate via web UI — works Delete the API-created account and recreate it through the **web admin UI** with the exact same email and password. IMAP auth succeeds immediately. ## IMAP log comparison Both API-created and UI-created accounts reach the `AUTHENTICATE PLAIN` stage. The API-created account causes the server to close the connection immediately after receiving the encoded credentials. The UI-created account returns `2 OK Authentication successful`. ## Expected behavior Accounts created via the REST API with plaintext passwords in `secrets` should authenticate via IMAP the same as accounts created through the web UI. ## Workaround Create all accounts through the web admin UI instead of the API.