fix(07): SMTP test falls back to stored username and adds 10s timeouts

Previously only the password fell back to stored value; username could be
missing if form field was cleared. Now both credentials fall back to the
stored config, ensuring auth is always tested when credentials exist.

Also adds explicit 10s timeouts to prevent indefinite hangs on unreachable
SMTP servers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/settings/settings.service.ts

@@ -124,11 +124,18 @@ export class SettingsService {
    */
   async testSmtpConfig(tenantId: string, dto: SmtpConfigDto): Promise<boolean> {
     let password: string | undefined = dto.password;
+    let username: string | undefined = dto.username;
 
-    // If no password submitted, fall back to the stored password
-    if (!password) {
+    // Fall back to stored credentials for anything not provided in the DTO.
+    // The form never pre-fills the password field (T-07-17), so we always
+    // need to load it from storage. Username may also be absent if the form
+    // field was cleared, so load it too.
+    if (!password || !username) {
       const stored = await this.getDecryptedSmtpConfig(tenantId);
-      password = stored?.decryptedPassword ?? undefined;
+      if (stored) {
+        if (!password) password = stored.decryptedPassword ?? undefined;
+        if (!username) username = stored.username ?? undefined;
+      }
     }
 
     try {
@@ -137,8 +144,11 @@ export class SettingsService {
         port: dto.port,
         secure: dto.encryption === 'ssl-tls',
         requireTLS: dto.encryption === 'starttls',
-        auth: dto.username
-          ? { user: dto.username, pass: password ?? '' }
+        connectionTimeout: 10_000,
+        greetingTimeout: 10_000,
+        socketTimeout: 10_000,
+        auth: username
+          ? { user: username, pass: password ?? '' }
           : undefined,
       });