Fix SMTP auth: settings tab saved wrong config keys

The Settings → E-mailrapport tab (scheduler.js) saved the SMTP username
as `user` and TLS flag as `starttls`, but every backend reader expects
`username`/`use_tls` (routes/email.py). Result: username was always
empty, server.login() was skipped, and the SMTP server rejected the
send — surfacing as a misleading "authentication failed" message even
with a valid App Password. The bug was latent because Graph is preferred
whenever M365 is connected, so the SMTP path was rarely exercised.

- scheduler.js: send/load canonical keys (username, use_tls). The
  send-report modal (scan.js) already used these.
- _load_smtp_config(): normalise legacy user→username / starttls→use_tls
  so configs saved before the fix work without re-entry.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

app_config.py

@@ -878,6 +878,13 @@ def _load_smtp_config() -> dict:
             cfg = json.loads(_SMTP_CONFIG_PATH.read_text(encoding="utf-8"))
             if cfg.get("password"):
                 cfg["password"] = _decrypt_password(cfg["password"])
+            # Normalise legacy key names written by an older settings-tab UI
+            # (`user`/`starttls`) to the canonical keys every reader expects
+            # (`username`/`use_tls`), so configs saved before the fix still work.
+            if "username" not in cfg and "user" in cfg:
+                cfg["username"] = cfg["user"]
+            if "use_tls" not in cfg and "starttls" in cfg:
+                cfg["use_tls"] = cfg["starttls"]
             return cfg
     except Exception:
         pass