audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/inbound/service.go

@@ -70,12 +70,37 @@ func (s *Service) SetTransport(id int64, host, portRaw, tlsMode string) error {
 	if err := checkTLSMode(tlsMode); err != nil {
 		return err
 	}
+	if err := s.checkOneTLSModePerUpstream(id, host, port, tlsMode); err != nil {
+		return err
+	}
 	if err := s.store.UpdateInboundTransport(id, host, port, tlsMode); err != nil {
 		return err
 	}
 	return s.Resync()
 }
 
+// checkOneTLSModePerUpstream refuses an upstream another inbound domain
+// already forwards to with another TLS mode. Postfix's TLS policy is keyed by
+// the next hop, not by the domain (smtp_tls_policy_maps; Postfix 3.7.11,
+// README_FILES/TLS_README: the key is the verbatim next-hop), so two domains
+// to one [host]:port share one mode: the map held both keys, and the first by
+// domain name won with a warning - the form's choice for the second domain
+// was not what Postfix did (audit 2026-10-12, L5).
+func (s *Service) checkOneTLSModePerUpstream(id int64, host string, port int, tlsMode string) error {
+	domains, err := s.store.ListInboundDomains()
+	if err != nil {
+		return err
+	}
+	for _, d := range domains {
+		if d.ID == id || d.Port != port || normalizeHost(d.Host) != host || d.TLSMode == tlsMode {
+			continue
+		}
+		return invalid("[%s]:%d is already the upstream of %s, with TLS mode %s: an upstream has one TLS mode - choose %s here, or change it on %s first",
+			host, port, d.Name, d.TLSMode, d.TLSMode, d.Name)
+	}
+	return nil
+}
+
 // SetRecipients validates the mode and, in list mode, every address, then
 // rebuilds the maps.
 func (s *Service) SetRecipients(id int64, mode string, rawAddresses []string) error {