Add optional inbound relay (backup-MX) behind INBOUND_RELAY_ENABLE.

Port 25 accepts only configured domains and listed recipients, then forwards to an upstream; the outbound path is unchanged when the flag is off.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/product.md

@@ -50,18 +50,19 @@ Explicitly excluded to prevent scope creep:
 - Organisations / tenancy beyond global + domain-admin roles; managing
   **multiple sending domains** under one global administrator is in scope (see
   below)
-- Inbound antispam/antivirus (rspamd, ClamAV, etc.)
+- Inbound antispam/antivirus engines (rspamd, ClamAV, etc.) — SelfPost may
+  expose a milter hook; it does not ship or start a filter
 - A custom MTA — Postfix is used as-is
 - Dovecot or a full mail stack for SASL — Cyrus SASL (`sasldb2`) only
 
 The **domain-admin** role ships in the current line (global administrator plus
-domain administrators with assigned domains). The optional **inbound relay** is
-the main agreed **1.x+** extension still on the
-[roadmap](roadmap.md) — it targets a 1.x MINOR bump by default; a 2.x major
-remains possible pending implementation. Items marked *candidate* in the
-roadmap require explicit approval before coding (including **send-log retention
-in Settings**, **30-day send statistics**, and **auto level-2 rate limits** —
-see linked plans there).
+domain administrators with assigned domains). The optional **inbound relay**
+(backup-MX / forwarder on port 25) is an agreed 1.x extension — off by default
+behind `INBOUND_RELAY_ENABLE`; it is relay/forward, not IMAP/webmail. Items
+marked *candidate* in the
+[roadmap](roadmap.md) require explicit approval before coding (including
+**send-log retention in Settings**, **30-day send statistics**, and **auto
+level-2 rate limits** — see linked plans there).
 
 ---