fix(07): CR-03 close IMAP connection when getMailboxLock throws

If getMailboxLock() failed (e.g. folder not found) the try/finally cleanup
block was never entered, leaving the ImapFlow connection open and leaking.
Move the lock acquisition inside the try block and use lock?.release() in
finally so client.logout() is always called regardless of lock success.

apps/api/src/dkv/providers/imap.provider.ts

@@ -104,10 +104,14 @@ export class ImapProvider implements InboxProvider {
     const client = this.buildClient(config);
 
     await client.connect();
-    const lock = await client.getMailboxLock(config.folder || 'INBOX');
+    // lock is declared outside try so the type is available in finally, but
+    // getMailboxLock() itself is inside the try so that a lock failure still
+    // triggers client.logout() — preventing a connection leak (CR-03).
+    let lock: Awaited<ReturnType<typeof client.getMailboxLock>> | null = null;
     const results: InboxEmail[] = [];
 
     try {
+      lock = await client.getMailboxLock(config.folder || 'INBOX');
       // Search for emails from the configured sender
       const searchQuery = config.senderFilter
         ? { from: config.senderFilter }
@@ -170,7 +174,7 @@ export class ImapProvider implements InboxProvider {
         }
       }
     } finally {
-      lock.release();
+      lock?.release();
       await client.logout();
     }