feat: implement B.3 — fatal SELFPOST_HOSTNAME check in entrypoint.sh

Unset or malformed hostname makes the panel and Postfix diverge on SASL
realm silently (auth breaks for every application) and breaks HELO/PTR
matching (spam), so entrypoint.sh now exits before postfix-config.sh /
supervisord with an explanatory error, plus a syntax check rejecting
missing dots, schemes, ports, and whitespace.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/.env.example

@@ -1,8 +1,9 @@
 # Copy to .env next to docker-compose.yml and fill in.
 
-# Hostname used both for the panel's TLS vhost and for Postfix's SASL realm
-# (SASL_REALM defaults to this) and myhostname. Must match the certificate
-# your reverse proxy obtains.
+# Required — the container refuses to start without it. Hostname used both for
+# the panel's TLS vhost and for Postfix's SASL realm (SASL_REALM defaults to
+# this) and myhostname; must also match your PTR record. Must match the
+# certificate your reverse proxy obtains. Bare FQDN only — no scheme or port.
 SELFPOST_HOSTNAME=mail.example.com
 
 # Set to true to also enable RFC 6409 submission (587/STARTTLS) alongside the