audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/postfix/inbound_test.go

@@ -117,3 +117,22 @@ func TestRebuildInboundMapsEmptyOmitsPending(t *testing.T) {
 		}
 	}
 }
+
+// Two domains forwarded to one next hop share its TLS policy line: the map
+// holds the key once (audit 2026-10-12, L5).
+func TestRenderInboundMapsOneTLSLinePerNextHop(t *testing.T) {
+	routes := []InboundRoute{
+		{Domain: "b.example", Host: "10.0.0.8", Port: 25, TLSMode: "encrypt", RecipientMode: "any"},
+		{Domain: "a.example", Host: "10.0.0.8", Port: 25, TLSMode: "encrypt", RecipientMode: "any"},
+	}
+	_, transport, _, tlsPolicy, err := renderInboundMaps(routes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(transport) != "a.example smtp:[10.0.0.8]:25\nb.example smtp:[10.0.0.8]:25\n" {
+		t.Errorf("transport = %q", transport)
+	}
+	if string(tlsPolicy) != "[10.0.0.8]:25 encrypt\n" {
+		t.Errorf("tls_policy = %q, want the next hop once", tlsPolicy)
+	}
+}