docs(docker-mailserver): document plaintext IMAP exposure risk

Notes the service.exposePlaintextImap toggle added in the previous
commit, and why it defaults to false.

Signed-off-by: Rishi <rishi@obmondo.com>

Author: MAVRICK-1

argocd-helm-charts/docker-mailserver/charts/docker-mailserver/README.md

@@ -241,6 +241,22 @@ Enabling the PROXY protocol will create an additional port for each protocol (by
 
 If you do not enable the PROXY protocol and your mail server is not exposed using a load-balancer service with an external traffic policy in "Local" mode, then all incoming mail traffic will look like it comes from a local Kubernetes cluster IP.
 
+### Security: don't expose plaintext IMAP
+
+Enabling IMAP (`ENABLE_IMAP: 1`) makes the chart create Service ports for both plaintext IMAP
+(143) and TLS IMAPS (993). If your Service type is `LoadBalancer` or `NodePort`, port 143 is then
+reachable from the internet, unencrypted, alongside 993 - this has been caught in production as a
+real external exposure.
+
+`service.exposePlaintextImap` defaults to `false`: only IMAPS (993, and its proxy-protocol variant
+10993) is exposed on the Service. The container itself still listens on 143 internally; it's just
+not published externally unless you explicitly opt in.
+
+```yaml
+service:
+  exposePlaintextImap: false  # set true only if a client genuinely cannot do IMAPS
+```
+
 [dms-docs::k8s::network-config]: https://docker-mailserver.github.io/docker-mailserver/latest/config/advanced/kubernetes/#exposing-your-mail-server-to-the-outside-world
 [dms-docs::k8s::proxy-protocol]: https://docker-mailserver.github.io/docker-mailserver/latest/config/advanced/kubernetes/#proxy-port-to-service-via-proxy-protocol
 [k3s-klipperlb-pp]: https://github.com/docker-mailserver/docker-mailserver-helm/issues/176#issuecomment-3097915161