feat(admin): Phase 4 — doctor, admin completeness, and bubbletea TUI

Adds the admin/diagnostics surface from SPEC §7.2:

- doctor [--account]: per-account IMAP + (RW) SMTP connectivity/auth checks via
  new mail.CheckIMAP/CheckSMTP (connect+auth only, no mail). Exit non-zero on any
  failure; secrets never printed.
- store.UpdateAccount: partial edit, re-encrypts password/secrets only when a
  non-empty value is supplied (blank keeps existing). RecentAuditFor(account).
- config set/get (validates audit_retention_days), audit list [--account][--limit],
  account edit (flag partial-update) / remove [--yes].
- internal/tui: bubbletea AccountForm with pure, fully-tested Fields (validation +
  store.Account assembly + edit prefill). init / bare `account add` / `account edit
  --name X` drop into the TUI; flag forms remain for scripting.

Built test-first; full suite green incl -race. Validated live against the mxlogin
(password) and Gmail (app-password) accounts. Live validation caught a real bug:
doctor authenticated with empty passwords because it iterated ListAccounts (which
strips secrets) — fixed to re-fetch via GetAccount, locked in by a regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/cli/run.go

@@ -44,8 +44,47 @@ func realSender(acc store.Account, m mail.OutgoingMessage) error {
 	}, m)
 }
 
+func realCheckIMAP(acc store.Account) error {
+	return mail.CheckIMAP(mail.IMAPConfig{
+		Host: acc.IMAPHost, Port: acc.IMAPPort, Security: acc.IMAPSecurity,
+		Username: acc.Username, Password: acc.Password,
+	})
+}
+
+func realCheckSMTP(acc store.Account) error {
+	return mail.CheckSMTP(mail.SMTPConfig{
+		Host: acc.SMTPHost, Port: acc.SMTPPort, Security: acc.SMTPSecurity,
+		Username: acc.Username, Password: acc.Password,
+	})
+}
+
 func newDepsLive(st *store.Store, out io.Writer) Deps {
-	return Deps{Store: st, Dial: realMailer, Send: realSender, Now: time.Now, Out: out}
+	return Deps{
+		Store: st, Dial: realMailer, Send: realSender,
+		CheckIMAP: realCheckIMAP, CheckSMTP: realCheckSMTP,
+		Now: time.Now, Out: out,
+	}
+}
+
+// runDoctor handles `doctor [--account <name>]` (human-readable diagnostics).
+func runDoctor(args []string, out, errOut io.Writer) int {
+	fs := flag.NewFlagSet("doctor", flag.ContinueOnError)
+	fs.SetOutput(errOut)
+	account := fs.String("account", "", "check only this account")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	st, err := openStore()
+	if err != nil {
+		fmt.Fprintf(errOut, "emcli: %v\n", err)
+		return 1
+	}
+	defer st.Close()
+	d := newDepsLive(st, out)
+	if err := DoctorCmd(d, *account); err != nil {
+		return 1
+	}
+	return 0
 }
 
 // Run routes a command line and returns an exit code.
@@ -64,6 +103,14 @@ func Run(args []string, out, errOut io.Writer) int {
 		return runAccount(rest, out, errOut)
 	case "whitelist":
 		return runWhitelist(rest, out, errOut)
+	case "config":
+		return runConfig(rest, out, errOut)
+	case "audit":
+		return runAudit(rest, out, errOut)
+	case "doctor":
+		return runDoctor(rest, out, errOut)
+	case "init":
+		return runInit(rest, out, errOut)
 	default:
 		fmt.Fprintf(errOut, "emcli: unknown command %q\n", cmd)
 		return 2