logtail: a log rotated while the panel was down is read to its end (stage 2b)

At start, a saved offset whose fingerprint was not the current file's meant
"start on the new file": what Postfix wrote between the panel's stop and the
rotation was never read - delivery statuses, stored lines, refusals, inbound
journal rows, the deferred counter.

- tracker.resume marks the case (behind, prev); follow calls readRotated
  before the new file: it opens mail.log.1 (delaycompress leaves it plain),
  checks by fingerprint that it is the file the place belongs to, reads it
  from the saved offset to its end through handle (catching up: the
  once-protections apply) and flushes the stored lines.
- Not found, not that file, or the offset past its end (rotated twice):
  logged, with the saved place's time - from when nothing was read.
- The fingerprint gains the file's identity (device.inode, fileid_unix.go;
  empty elsewhere): two logs that begin alike are two files - the
  review-2026-08-followups row on collisions. A fingerprint saved before
  (hash alone) still matches by its hash (sameLog), so the first start after
  the upgrade resumes where it was.
- store.LogtailState reads back updated_at.

Tests: stop, append, rotate, append, start - both halves read, once each,
the earlier line not again; a mail.log.1 that is another file is not read
from the place; sameLog with an old and a new fingerprint.

CHANGELOG [Unreleased], audit plan line ticked, roadmap 23/62.
Evidence: GOOS=linux go vet ./internal/logtail clean; go test ./internal/logtail
ok on Windows but for TestFollowTailsAndRotates; the server run follows
before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,18 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Fixed
+
+- **A log rotated while the panel was down is read to its end.** On start,
+  a saved place in a file that had been rotated meant "start on the new
+  file", and what Postfix wrote between the panel's stop and the rotation -
+  deliveries, refusals, deferrals - was never read. The tailer now reads the
+  rotated file (`mail.log.1`) from the saved place to its end first; when
+  that file is not the one the place belongs to (rotated twice), it says so
+  in the log, with the time from which nothing was read. The log's
+  fingerprint now includes the file's inode, so two files that begin alike
+  are still told apart (audit 2026-10-12, stage 2b).
+
 ## [2.5.0] - 2026-10-14
 
 Stages 1 and 2 of the 2026-10-12 audit: mail the delivery log showed wrong,