Looks like this was a versioning issue ie. berkeley client library used by cyrus/downloaded by me must have been a different version to the berkley db suppled as suse rpm by my vps provider.
I downloaded & built the latest berkeley db, thne recompiled (sigh) all programs that use it.. including sasl2, apache, cyrus impad etc. And now, finally I have a fully working imapd mail server with smtp auth all running over tls to protect passwords when sending and receiving mail to imapd.
It was all extremely painful and difficult, but you've got to measure it against the even greater pain, expense and self-loathing
of using microsoft stuff instead. Suddenly it doesnt feel so painful after all.