Phase 10: deployment (Apache compose + proxy fragments, CI release) + docs

- deploy/docker-compose.yml: pinned-tag ghcr image, hardened (cap_drop ALL +
  minimal cap_add, no-new-privileges, panel bound to 127.0.0.1 only). Apache
  itself runs on the host (spec 10.5), fragment at deploy/apache/.
- Alternative reverse-proxy fragments: nginx (+certbot sidecar), Caddy
  (automatic ACME), Traefik (+acme.json PEM extraction script).
- .github/workflows/release.yml: tag-triggered ghcr.io publish, version piped
  from the git tag into both the binary ldflags and the image tag (spec 10.1).
- Closed a gap from Phase 1: logrotate was installed but never invoked;
  wired up build/logrotate-mail.conf + logrotate-loop.sh + a supervisor
  program (copytruncate, since postlogd holds mail.log open with nothing to
  signal on rotation).
- README rewritten: site requirements checklist, reverse-proxy comparison,
  DNS setup (server- vs domain-level), IP warmup, backup/restore vs domain
  export/import, fixed-tag rationale, machine requirements.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/apache/selfpost-vhost.conf

@@ -0,0 +1,41 @@
+# Example host Apache vhost for the SelfPost panel (spec 10.3, default
+# scenario). Install on the host running Apache — NOT inside the SelfPost
+# container. Requires mod_ssl and mod_proxy/mod_proxy_http enabled
+# (`a2enmod ssl proxy proxy_http`).
+#
+# Certificates: obtain with the Apache certbot plugin against THIS vhost
+# (`certbot --apache -d mail.example.com`). Certbot edits this file in place
+# to add the SSLCertificateFile/SSLCertificateKeyFile directives and a
+# :80 -> :443 redirect vhost, and renews in the background via its own timer.
+# The resulting PEM files land at
+# /etc/letsencrypt/live/mail.example.com/{fullchain,privkey}.pem on the host
+# — bind-mount that directory read-only into the SelfPost container (see
+# ../docker-compose.yml, the `./certs:/etc/postfix/tls:ro` volume) so Postfix
+# can present the very same certificate on 465/587. One certificate, two
+# consumers (spec 10 p.4) — no separate cert just for the panel.
+
+<VirtualHost *:443>
+	ServerName mail.example.com
+
+	# Filled in by `certbot --apache`; shown here for clarity.
+	# SSLEngine on
+	# SSLCertificateFile /etc/letsencrypt/live/mail.example.com/fullchain.pem
+	# SSLCertificateKeyFile /etc/letsencrypt/live/mail.example.com/privkey.pem
+
+	ProxyPreserveHost On
+	ProxyPass "/" "http://127.0.0.1:8080/"
+	ProxyPassReverse "/" "http://127.0.0.1:8080/"
+
+	# The panel is plain HTTP behind the proxy; it never terminates TLS
+	# itself (spec 10 p.2). Cookies are still marked Secure by the panel
+	# (spec 7.6.6) because the browser only ever sees this HTTPS vhost.
+</VirtualHost>
+
+<VirtualHost *:80>
+	ServerName mail.example.com
+	# certbot's http-01 challenge needs this on plain :80; everything else
+	# redirects to HTTPS once certbot adds the RewriteRule/Redirect block.
+	RewriteEngine On
+	RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
+	RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [R=301,L]
+</VirtualHost>