refactor: große API-Handler-Dateien in fokussierte Module aufteilen

Reine Code-Verschiebung, keine Logikänderung. Betroffen:
- ldap_tenants.go (994 Zeilen) -> ldap_tenants.go (Routing) + ldap_handlers.go
  + tenant_handlers.go + tenant_domain_handlers.go + tenant_logo_handlers.go
  + tenant_helpers.go
- import_handlers.go (621 Zeilen) -> imap_handlers.go + pop3_handlers.go
  + import_helpers.go
- admin_handlers.go (702 Zeilen) -> admin_users_handlers.go +
  admin_status_handlers.go + admin_services_handlers.go +
  admin_security_handlers.go

Lokal kein Go-Build möglich — Verifikation manuell per Funktions- und
Import-Abgleich Alt/Neu (alle Symbole exakt einmal vorhanden). Build
muss vor Deploy auf 192.168.1.131/132 bestätigt werden.

internal/api/import_helpers.go

@@ -0,0 +1,16 @@
+package api
+
+import (
+	"archivmail/internal/auth"
+)
+
+// tenantAccessAllowed checks whether the given session may access an IMAP/POP3
+// account belonging to accTenantID. Superadmins (sess.TenantID == nil) may
+// access any tenant. Other admins may only access accounts within their own
+// tenant (accTenantID must be set and match).
+func tenantAccessAllowed(sess *auth.Session, accTenantID *int64) bool {
+	if sess.TenantID == nil {
+		return true
+	}
+	return accTenantID != nil && *accTenantID == *sess.TenantID
+}