inbound-antispam-panel: inbound journal milter on port 25

Step 3/12 of docs/plans/inbound-antispam-panel.md.

The panel serves a second milter while the inbound relay is on
(internal/milter/inbound.go, socket INBOUND_JOURNAL_MILTER_SOCKET,
default /run/selfpost/inbound-journal.sock). build/postfix-config.sh
puts it last on port 25, after the optional antispam milter, with
default_action=accept; postfix-wrapper.sh waits for its socket. At
end-of-message it writes one inbound_spam_log row per recipient at an
inbound domain - other port-25 recipients (DMARC report addresses) get
none - and always accepts. With a filter attached it reads the verdict
from X-Rspamd-Action and X-Spamd-Result (action, score, up to six
weighted symbols, only what the patterns recognise, 255 bytes); without
one those headers are the sender's and are not read. The plan named
X-Rspamd-Score, which rspamd does not have.

The antispam compose fragment mounts rspamd/milter_headers.conf into
the sidecar so that it adds the two headers (checked in rspamd 3.11:
both routines exist and remove a sender's own headers of those names).

Store: InsertInboundSpam, IsInboundDomain.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok - the relayed message of
inbound_relay_delivers_and_refuses has its journal row (accept by
selfpost) and the DMARC report sent through the same listener has none.

Not yet seen in a real run: a verdict written by rspamd reaching this
milter. The e2e stand has no filter, and the test server's only inbound
domain has no upstream, so it accepts no mail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/main.go

@@ -96,7 +96,10 @@ type config struct {
 	// what attaches it; the panel only says so. See antispamAction.
 	inboundAntispamMilter string
 	inboundAntispamAction string
-	dmarcEnabled          bool
+	// The inbound journal milter's socket; the default mirrors
+	// build/postfix-config.sh. Served only while the inbound relay is on.
+	inboundJournalSocket string
+	dmarcEnabled         bool
 }
 
 func loadConfig() config {
@@ -162,6 +165,7 @@ func loadConfig() config {
 		inboundEnabled:        os.Getenv("INBOUND_RELAY_ENABLE") == "true",
 		inboundAntispamMilter: os.Getenv("INBOUND_ANTISPAM_MILTER"),
 		inboundAntispamAction: antispamAction(os.Getenv("INBOUND_ANTISPAM_MILTER_ACTION")),
+		inboundJournalSocket:  envDefault("INBOUND_JOURNAL_MILTER_SOCKET", "/run/selfpost/inbound-journal.sock"),
 		// Optional DMARC aggregate ingest on port 25. Off unless exactly "true".
 		dmarcEnabled: os.Getenv("DMARC_REPORTS_ENABLE") == "true",
 	}
@@ -294,7 +298,7 @@ func run() error {
 	}
 
 	var wg sync.WaitGroup
-	errc := make(chan error, 4)
+	errc := make(chan error, 5)
 
 	roles := []struct {
 		name string
@@ -318,6 +322,13 @@ func run() error {
 		}},
 	}
 
+	if cfg.inboundEnabled {
+		roles = append(roles, struct {
+			name string
+			fn   func(context.Context) error
+		}{"inbound-journal-milter", func(ctx context.Context) error { return serveInboundJournal(ctx, cfg, st) }})
+	}
+
 	for _, r := range roles {
 		wg.Add(1)
 		go func(name string, fn func(context.Context) error) {