inbound-antispam-panel: refused inbound mail from mail.log; retention

Step 4/12 of docs/plans/inbound-antispam-panel.md.

The log tailer writes an inbound_spam_log row for mail port 25 refused
(internal/logtail/inbound.go): a "reject:" line of the port-25 smtpd is
Postfix's own policy; a milter-reject / milter-hold / milter-discard
line of cleanup is the filter's verdict. Only a recipient at an inbound
domain is a row, so "Relay access denied" for a stranger's domain is
not. The row is dated by its log line; the reply text is cut to 255
bytes of printable ASCII; a reply starting with 4 is a tempfail.

To tell port 25 from 465 / 587 the listener now logs as
postfix/inbound (syslog_name). cleanup logs under one name for every
listener, so its verdict counts only for a queue id the port-25 smtpd
was seen to open (4096 remembered). Lines are matched from the head,
after timestamp and host: their tail is the sender's own text.

Retention: PruneInboundSpam every six hours - older than the
inbound_spam_log_retention_days setting (seeded from
INBOUND_SPAM_LOG_RETENTION_DAYS, 90, range 7-365), then down to 10 000
rows. The setting has no field in the panel yet.

Known limits, in architecture.md: a log line names one recipient, so a
message refused at end-of-message is one row; a line re-read after an
unclean stop would be a second row.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok - the unknown recipient at
the inbound domain refused on port 25 has its row (reject by postfix),
the stranger's domain has none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/main.go

@@ -99,7 +99,9 @@ type config struct {
 	// The inbound journal milter's socket; the default mirrors
 	// build/postfix-config.sh. Served only while the inbound relay is on.
 	inboundJournalSocket string
-	dmarcEnabled         bool
+	// Retention of the inbound journal until Server > Settings says otherwise.
+	inboundSpamLogRetentionDays int
+	dmarcEnabled                bool
 }
 
 func loadConfig() config {
@@ -166,6 +168,8 @@ func loadConfig() config {
 		inboundAntispamMilter: os.Getenv("INBOUND_ANTISPAM_MILTER"),
 		inboundAntispamAction: antispamAction(os.Getenv("INBOUND_ANTISPAM_MILTER_ACTION")),
 		inboundJournalSocket:  envDefault("INBOUND_JOURNAL_MILTER_SOCKET", "/run/selfpost/inbound-journal.sock"),
+
+		inboundSpamLogRetentionDays: envInt("INBOUND_SPAM_LOG_RETENTION_DAYS", store.InboundSpamLogRetentionDaysDefault),
 		// Optional DMARC aggregate ingest on port 25. Off unless exactly "true".
 		dmarcEnabled: os.Getenv("DMARC_REPORTS_ENABLE") == "true",
 	}
@@ -296,6 +300,22 @@ func run() error {
 	if err := st.EnsureSendLogRetentionDays(cfg.retentionDays); err != nil {
 		return fmt.Errorf("bootstrap send-log retention: %w", err)
 	}
+	// With the inbound relay on, the tailer also writes the inbound journal's
+	// rows for refused mail and prunes that journal.
+	var inboundTail *logtail.Inbound
+	if cfg.inboundEnabled {
+		if err := st.EnsureInboundSpamLogRetentionDays(cfg.inboundSpamLogRetentionDays); err != nil {
+			return fmt.Errorf("bootstrap inbound journal retention: %w", err)
+		}
+		inboundTail = &logtail.Inbound{Store: st, Retention: func() int {
+			days, err := st.GetInboundSpamLogRetentionDays(cfg.inboundSpamLogRetentionDays)
+			if err != nil {
+				log.Printf("inbound journal retention: %v", err)
+				return cfg.inboundSpamLogRetentionDays
+			}
+			return days
+		}}
+	}
 
 	var wg sync.WaitGroup
 	errc := make(chan error, 5)
@@ -314,7 +334,7 @@ func run() error {
 					return cfg.retentionDays
 				}
 				return days
-			})
+			}, inboundTail)
 		}},
 		{"rate-limit-recalc", func(ctx context.Context) error {
 			runAutoRateLimitRecalc(ctx, cfg, st)