release: 2.5.1: audit stage 2b - the log tailer and what the panel shows of a refusal

A log rotated while the panel was down is read to its end; the deferred
counter remembers a place in the log, not a second; a refused message's
page shows what Postfix wrote; a refusal the panel did not get to write is
written from mail.log; downtime is estimated (≈) when supervisord is
silent; the Sender check card counts connections and messages apart (the
owner's decision); a message the sweep closed says the panel closed it.
Plus the findings of both reviews of the stage.

Rolled out to the test server as 2.5.0-post.e1ddf12 (the same code):
migration 0009 ran on the live database - schema 9, the new columns in
place, 68/68 send-log rows still tied to their domain, integrity ok.

CHANGELOG cut; pin 2.5.1 in deploy/docker-compose.yml, README (with the
local-build note), guide; development.md "from pin"; roadmap row and the
recommended order; stage 2b marked shipped in the plan. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -729,7 +729,7 @@ has already run is never edited — the next file is added; the published
    loses nothing. Test pins the reply text; e2e's sender-check negatives
    assert the reply does not contain the other tenant's name. — **Opus**
 
-### Stage 2b — the log tailer, and what the panel shows of a refusal → `2.5.1`
+### Stage 2b — the log tailer, and what the panel shows of a refusal → `2.5.1` (shipped 2026-10-14)
 
 Split off stage 1 on 2026-10-14 at the owner's word: the six steps below were
 agreed on 2026-10-13/14, after the plan, and had made stages 1 and 2 a cut of