inbound-antispam-panel: Inbound > Log and Inbound > Filter lists

Step 6/12 of docs/plans/inbound-antispam-panel.md. Written by a Sonnet
subagent from the mockups, reviewed and corrected by me.

GET /inbound/log - the journal a page at a time (50), filtered by
domain, decision and day; QueryInboundSpam / CountInboundSpam with the
viewer's inbound domains as the scope. The global role reads all of it
and gets "Deny sender" / "Allow sender" links into the lists; a user
with the domain role reads the rows of the inbound domains assigned to
them, without the links. The plan said global-only for the journal;
the accepted mockup and 2.0's delegation of Inbound say otherwise -
recorded in the plan as built.

GET, POST /inbound/filter-lists and POST .../{id}/delete - global role,
404 otherwise. Add form (prefilled from the query), the two lists with
Remove as the kit's row action, and "Where the lists go" with the
filter's state and when the maps were last written
(Lists.LastWritten). A refused or duplicate entry is 422 with the
message and what was typed.

Server > Settings: "Keep inbound log rows, days" with the relay on.
Help: Inbound log, Filter lists. Navigation: Log for everyone who sees
Inbound, Filter lists for the global role (Shell.ShowFilterLists).
Status tags accept / reject / tempfail join the kit's mapping.

Tests: page fixtures for both screens, held to outlines.json; view and
handler tests (both roles, filters, paging, relay off, add / duplicate
/ invalid / delete, map file content, settings field, help). e2e reads
the journal from the page instead of the database and adds and removes
a deny entry through the panel, reading deny_domain.map after each.

Seen: both pages and Settings rendered from their fixtures and compared
with the mockups side by side (headless Edge, 1360 px) - same layout
and wording.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -23,7 +23,7 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   of a message that was accepted for an inbound domain: client address,
   envelope, subject and - with a spam filter attached - the filter's action,
   score and heaviest symbols. It only watches: it refuses nothing and Postfix
-  accepts mail when it is down. There is no page for the journal yet.
+  accepts mail when it is down.
 - **Refused inbound mail is recorded too**, from the mail log: a recipient
   Postfix refused at an inbound domain (unknown user, sender domain not
   found), and a message the spam filter rejected, deferred, held or
@@ -42,8 +42,18 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   They are written as six files under `data/antispam/`, which the fragment
   mounts into the sidecar together with `antispam/rspamd/multimap.conf`;
   rspamd rereads a changed file by itself. Deny wins over allow. The files
-  are there from the first start with the inbound relay on; the page that
-  edits the lists comes next.
+  are there from the first start with the inbound relay on.
+- **Inbound › Log**: the journal as a page - time, sender and client address,
+  recipient, subject, decision and why, filtered by domain, decision and day.
+  A user with the *domain* role sees the rows of the inbound domains assigned
+  to them. For the global role each row links to the filter lists with the
+  sender filled in (*Deny sender* / *Allow sender*).
+- **Inbound › Filter lists** (global role): add and remove allow and deny
+  entries; the page says where the lists go and whether the filter is on to
+  read them.
+- **Server › Settings**: *Keep inbound log rows, days*, shown with the inbound
+  relay on.
+- Help: *Inbound log* and *Filter lists*.
 - New setting `ANTISPAM_DIR` (default `/data/antispam`).
 - New setting `INBOUND_JOURNAL_MILTER_SOCKET` (default
   `/run/selfpost/inbound-journal.sock`).