auth: prefer AUTH LOGIN over PLAIN when the server advertises both

[LeoneNee]

Problem

authSteps prefers AUTH PLAIN whenever the server advertises it. Some servers list PLAIN in their EHLO capabilities but reject it in practice — observed with QQ Mail (smtp.qq.com), which answers an AUTH PLAIN attempt with 502 Invalid input / 535 Login fail yet completes AUTH LOGIN with the same credentials. Sign-in email delivery fails with valid credentials and no recourse, because PLAIN is always picked when advertised.

Change

Try AUTH LOGIN first; fall back to PLAIN only when LOGIN is not advertised. LOGIN is a single extra round trip and is accepted everywhere PLAIN is, so preferring it strictly widens server compatibility.

Tests

• The fake SMTP server in smtp.test.ts now speaks the LOGIN challenge-response (334 base64 prompts) instead of treating every AUTH line as one-shot.
• The delivery and verification tests assert the LOGIN transcript (AUTH LOGIN, base64 username, base64 password).
• A new case covers a server advertising only PLAIN, keeping the fallback path covered.

All 8 tests in plugins/auth/test/smtp.test.ts pass. The fix was also verified against a live QQ Mail account: AUTH LOGIN completes (235 Authentication successful) where AUTH PLAIN is rejected.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}