iOS 17.4.1 (maybe) randomly wipes imap passwords.

I have 6 email accounts attached to the mail app on my iphone Xs. They all connect by IMAP - one is to a google workspace account, the other 5 connect to a local server that I control, running Dovecot.

• I recently upgraded to iOS 17.4.1 (whenever it became available).
• three days ago, one of the imap accounts said error checking for mail on one account, to which the details were "no password provided". All other accounts were working, send and receive.
• The same accounts were also working on other devices - Windows and Linux PCs - with no problems.
• When I went to paste in the password, it then failed with "invalid email address" and refused to accept the password change.
• earlier today, another of the local imap accounts suddenly lost its password from the phone.
• One suggestion elsewhere in this community said it was needing a password for smtp, but my system does not use one (and the settings UI still shows them as optional). I tried anyway, but it failed with a very unhelpful message: 'Name or password for "smtp.my.domain..' and that was all the popup said. So I deleted smtp login details again and it went back to as it was.
• At that stage I checked the server logs and there was no record of any auth failures or other problems, so I increased debugging logging to see if the iphone was even attempting to connect.
• I reapplied the same password back to the second account that had failed, and it started working again.
• So I went back to the original failed account, but it still showed the same problems, saying I had an invalid email address. That address has an alias, permitting me to send as either - I tried switching the default, but that made no difference. In the end I had to delete the second address, validate the password, and then I could add the second address back in again. This is clearly a bug, but it may be long-standing.
• So, the phone is currently working as before, but I am left wondering why it decided to arbitrarily wipe out the password for two accounts - on two different days. And when will it do it again?

All the clients use the same protocols: TLS 1.3 over port 993 with password auth.