milter: the level-2 limit and the client IP list hold for every message

Security fix, outside the inbound antispam feature. Found by its
technical review (Opus, 2026-10-12), reproduced on the test stand
before the fix: over an application's level-2 limit, two MAIL FROM on
one connection were answered 451 and then accepted.

Cause. Postfix introduces a client to a milter once per connection.
The milter library (go-milter 0.4.1, session.go) replaces the milter's
session after any reply that is not "continue" - a refusal, or the
accept that used to end a message. The new session never saw Connect,
so it had no client address, and both checks passed a message without
one: overLimit returned early ("no client IP to key on") and
authIPAllowed did the same. So every message after the first on a
connection, and every MAIL FROM after a refused one, skipped the
level-2 limit and an application's client IP list. In the code since
1.9.0 for the list and longer for the limit.

Fix.
  - build/postfix-config.sh: milter_mail_macros carries {client_addr},
    so the address comes with every MAIL FROM; MailFrom reads it (both
    spellings of IPv6) in the journal milter and the inbound journal
    milter.
  - overLimit no longer asks for a client address: a ceiling is on a
    domain or an application.
  - authIPAllowed refuses an application that has a client IP list when
    no address is known.
  - Body replies "continue" in both milters, which lets the message
    through as "accept" did and keeps the session.

The inbound journal milter had the same cause with a smaller effect:
rows of a connection's later messages had no client address.

In the same file, the checks of INBOUND_ANTISPAM_MILTER and
INBOUND_JOURNAL_MILTER_SOCKET refuse any character outside their set
first: a glob's "*" matched anything after the first characters.

Tests: a session that never saw Connect is judged by the macro, a
listed and an unlisted address, no address, not an address; the limit
with no client address; the inbound milter answers only "continue".
test/e2e sends two MAIL FROM on one connection over the limit and
wants both refused.

Checked on the test server: e2e red before the fix on exactly that
check, green after; go vet ./... ok, go test ./... ok (22 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/milter/inbound.go

@@ -27,8 +27,8 @@ type InboundStore interface {
 // of a message that reached end-of-message - that is, one the filter did not
 // refuse; refusals never get this far and are read from mail.log instead.
 //
-// Like the send-log milter it only watches: every callback continues or
-// accepts, and Postfix attaches the socket with default_action=accept, so
+// Like the send-log milter it only watches: every callback continues, and
+// Postfix attaches the socket with default_action=accept, so
 // neither an error here nor the panel being down holds up inbound mail.
 type inboundSession struct {
 	milter.NoOpMilter
@@ -38,7 +38,10 @@ type inboundSession struct {
 	// by the sender, and are not read.
 	filter bool
 
-	clientIP string // once per connection
+	// clientIP is taken at Connect and again from {client_addr} with every
+	// MAIL FROM: a session the library made after a non-continue reply never
+	// sees Connect (see session.MailFrom in milter.go).
+	clientIP string
 
 	from    string
 	rcpts   []string
@@ -58,6 +61,9 @@ func (s *inboundSession) Connect(host, family string, port uint16, addr net.IP,
 // MailFrom starts a message: a connection may carry several.
 func (s *inboundSession) MailFrom(from string, m *milter.Modifier) (milter.Response, error) {
 	s.reset()
+	if ip := clientAddr(m); ip != "" {
+		s.clientIP = ip
+	}
 	s.from = cleanAddress(from)
 	return milter.RespContinue, nil
 }
@@ -90,11 +96,12 @@ func (s *inboundSession) Header(name, value string, m *milter.Modifier) (milter.
 }
 
 // Body fires at end-of-message: the message is about to be queued for its
-// upstream.
+// upstream. "Continue" lets it through as "accept" would, and keeps this
+// session for the connection's next message.
 func (s *inboundSession) Body(m *milter.Modifier) (milter.Response, error) {
 	s.record()
 	s.reset()
-	return milter.RespAccept, nil
+	return milter.RespContinue, nil
 }
 
 func (s *inboundSession) Abort(m *milter.Modifier) error {