fix(auth): reject login attempts with bare usernames and enforce domain validation

[Aravinda-HWK]

📌 Description

This PR is to enforce to send email address when logging in.
Did update a few things related to Thunder version upgrade.

• Closes [BUG] IMAP authentication allows login with username-only and mismatched domain #267

---

🔍 Changes Made

• Update the auth.go for only accept email address not the username in the login process
• Now the response contain ouId instead of organizationId or any other variation.
• Now the Develop app is removed and instead that it contains console app.

✅ Checklist (Email System)

• Core IMAP commands tested (LOGIN, CAPABILITY, LIST, SELECT, FETCH, LOGOUT).
• Authentication is tested.
• Docker build & run validated.
• Configuration loading verified for default and custom paths.
• Persistent storage with Docker volume verified.
• Error handling and logging verified
• Documentation updated (README, config samples).

---

🧪 Testing Instructions

To test the server, use the instructions in the README in the test directory.

---

📷 Screenshots / Logs (if applicable)

---

⚠️ Notes for Reviewers

[gemini-code-assist]

Code Review

This pull request updates the authentication process to require email-based identities, rejecting bare usernames. It refactors domain validation to compare the login domain against domains derived from the identity provider or organizational units. Integration and unit tests have been updated to enforce these requirements. Feedback was provided regarding a redundant check for an empty email string that can be removed to simplify the code.

[maneeshaxyz]

LGTM.