Phase 10: deployment (Apache compose + proxy fragments, CI release) + docs

- deploy/docker-compose.yml: pinned-tag ghcr image, hardened (cap_drop ALL +
  minimal cap_add, no-new-privileges, panel bound to 127.0.0.1 only). Apache
  itself runs on the host (spec 10.5), fragment at deploy/apache/.
- Alternative reverse-proxy fragments: nginx (+certbot sidecar), Caddy
  (automatic ACME), Traefik (+acme.json PEM extraction script).
- .github/workflows/release.yml: tag-triggered ghcr.io publish, version piped
  from the git tag into both the binary ldflags and the image tag (spec 10.1).
- Closed a gap from Phase 1: logrotate was installed but never invoked;
  wired up build/logrotate-mail.conf + logrotate-loop.sh + a supervisor
  program (copytruncate, since postlogd holds mail.log open with nothing to
  signal on rotation).
- README rewritten: site requirements checklist, reverse-proxy comparison,
  DNS setup (server- vs domain-level), IP warmup, backup/restore vs domain
  export/import, fixed-tag rationale, machine requirements.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/.env.example

@@ -0,0 +1,17 @@
+# Copy to .env next to docker-compose.yml and fill in.
+
+# Hostname used both for the panel's TLS vhost and for Postfix's SASL realm
+# (SASL_REALM defaults to this) and myhostname. Must match the certificate
+# your reverse proxy obtains.
+SELFPOST_HOSTNAME=mail.example.com
+
+# Set to true to also enable RFC 6409 submission (587/STARTTLS) alongside the
+# primary 465/smtps listener.
+SUBMISSION_ENABLE=false
+
+# Level-1 backstop rate limit (anvil) — see README "Rate limiting".
+RATE_LIMIT_MESSAGES_PER_IP=100
+RATE_LIMIT_WINDOW_SECONDS=3600
+
+# Days of send-log history kept before the background sweep deletes rows.
+SEND_LOG_RETENTION_DAYS=90