So, it turned out my workaround of putting SSH on the non-SSL IMAP port 143 wasn’t a great idea and I figured out something much more simple.
Of course, a cPanel update broke that workaround, so rather than futz with IMAP settings again, I disabled POP3. That freed up 995 and 110. So, I put SSH on 995 and cPanel doesn’t freak out with that.
Much easier, no need to muck with config files other than sshd_config, and it works just fine at the hospital with sshuttle.