fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/postfix-config.sh

@@ -45,10 +45,18 @@ SASLDB_PATH="${SASL_DB_PATH:-/data/sasl/sasldb2}"
 # when a client library needs STARTTLS on 587 instead of implicit TLS on 465).
 SUBMISSION_ENABLE="${SUBMISSION_ENABLE:-false}"
 
+# Delivery log, written by postlogd and read by the panel's log-tailer. It lives
+# under the persistent /data (not the ephemeral /var/log) so the delivery lines
+# for messages still marked "queued" survive a container recreate — without
+# them those rows could never be resolved (architecture.md § Log tailer). The
+# default must match cmd/panel/main.go's MAIL_LOG; entrypoint.sh creates the
+# directory and the file with the ownership postlogd writes and the panel reads.
+MAIL_LOG_PATH="${MAIL_LOG:-/data/log/mail.log}"
+
 # --- main.cf -----------------------------------------------------------------
 postconf -e \
 	"myhostname=${HOSTNAME_VALUE}" \
-	"maillog_file=/var/log/mail.log" \
+	"maillog_file=${MAIL_LOG_PATH}" \
 	"mydestination=" \
 	"relayhost=" \
 	"inet_interfaces=all" \