Phase 10: deployment (Apache compose + proxy fragments, CI release) + docs

- deploy/docker-compose.yml: pinned-tag ghcr image, hardened (cap_drop ALL +
  minimal cap_add, no-new-privileges, panel bound to 127.0.0.1 only). Apache
  itself runs on the host (spec 10.5), fragment at deploy/apache/.
- Alternative reverse-proxy fragments: nginx (+certbot sidecar), Caddy
  (automatic ACME), Traefik (+acme.json PEM extraction script).
- .github/workflows/release.yml: tag-triggered ghcr.io publish, version piped
  from the git tag into both the binary ldflags and the image tag (spec 10.1).
- Closed a gap from Phase 1: logrotate was installed but never invoked;
  wired up build/logrotate-mail.conf + logrotate-loop.sh + a supervisor
  program (copytruncate, since postlogd holds mail.log open with nothing to
  signal on rotation).
- README rewritten: site requirements checklist, reverse-proxy comparison,
  DNS setup (server- vs domain-level), IP warmup, backup/restore vs domain
  export/import, fixed-tag rationale, machine requirements.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/docker-compose.yml

@@ -0,0 +1,80 @@
+
+# SelfPost — default deployment, reverse-proxy = Apache (spec 10, 10.5).
+#
+# This file only runs SelfPost itself. Apache is assumed to already be
+# installed on the HOST (the target audience for this project typically runs
+# Apache there already — spec 10.5) and reverse-proxies HTTPS for the panel;
+# it is not containerised here. See ../apache/selfpost-vhost.conf for a ready
+# vhost fragment, and the "Reverse proxy" section of ../../README.md for the
+# certbot steps that produce the PEM files this compose file mounts.
+#
+# Usage:
+#   1. Copy this file (and .env.example as .env) next to your own ./data and
+#      ./certs directories, or adjust the paths below.
+#   2. Fill in .env (hostname, at least one strong TLS_CERT/KEY path).
+#   3. docker compose up -d
+#
+# The image tag below is FIXED on purpose (spec 10 p.10, 7.5.A): backup
+# restore compares the manifest version against the running binary's version,
+# so ":latest" would make that check meaningless. Bump the tag deliberately
+# when you want to upgrade.
+
+services:
+  selfpost:
+    image: ghcr.io/mixeme/selfpost:1.0.0
+    restart: unless-stopped
+    environment:
+      SELFPOST_HOSTNAME: "${SELFPOST_HOSTNAME:?set the mail/panel hostname, e.g. mail.example.com}"
+      # Path Postfix reads inside the container — matches the certs bind mount
+      # below. Point these at your reverse-proxy's PEM output (spec 10 p.2).
+      TLS_CERT_FILE: /etc/postfix/tls/fullchain.pem
+      TLS_KEY_FILE: /etc/postfix/tls/privkey.pem
+      # Set to true to also publish RFC 6409 submission (587/STARTTLS)
+      # alongside the primary 465/smtps listener (spec 5).
+      SUBMISSION_ENABLE: "${SUBMISSION_ENABLE:-false}"
+      # Level-1 backstop rate limit (anvil, spec 5.5, 7.4); per-domain/app
+      # limits (level 2) are configured later from the panel itself.
+      RATE_LIMIT_MESSAGES_PER_IP: "${RATE_LIMIT_MESSAGES_PER_IP:-100}"
+      RATE_LIMIT_WINDOW_SECONDS: "${RATE_LIMIT_WINDOW_SECONDS:-3600}"
+      # How long the send log keeps rows before the background sweep deletes
+      # them (spec 7.3, 9) — the main driver of /data growth over time.
+      SEND_LOG_RETENTION_DAYS: "${SEND_LOG_RETENTION_DAYS:-90}"
+    volumes:
+      # All persistent state lives under /data (spec 9): SQLite DB, DKIM keys,
+      # sasldb2, sender map, setup token. Back this up (panel button or the
+      # selfpost-backup CLI) before you touch it directly.
+      - ./data:/data
+      # Read-only: SelfPost only ever reads certificates, never manages them
+      # (spec 10 p.2). Point this at wherever your reverse-proxy/certbot
+      # writes PEM files, e.g. /etc/letsencrypt on the host.
+      - ./certs:/etc/postfix/tls:ro
+    ports:
+      # 465 (smtps, primary) and optionally 587 (submission/STARTTLS) are
+      # published directly — mail traffic bypasses Apache entirely, it only
+      # ever proxies the panel's HTTP(S) (spec 10 p.2-3). The panel itself
+      # (8080) is intentionally NOT published here: Apache reaches it over
+      # the host network at 127.0.0.1:8080 (see the vhost fragment), so the
+      # panel is never directly reachable from the internet without TLS.
+      - "465:465"
+      - "587:587"
+      - "127.0.0.1:8080:8080"
+    # Hardening (spec 10 p.6). SelfPost's entrypoint still needs to run as
+    # root very briefly to fix /data ownership and normalise permissions
+    # under the shared `selfpost` group (see build/entrypoint.sh) before
+    # supervisord drops the panel to an unprivileged user — so this cannot be
+    # `user: panel` or a fully read-only rootfs without breaking that startup
+    # self-healing. What IS applied: no privilege escalation past what the
+    # image already grants, and every Linux capability dropped except the
+    # small set Postfix/OpenDKIM genuinely need (binding <1024, chown/setuid
+    # during startup, and DAC overrides for cross-user file access within the
+    # shared group).
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - NET_BIND_SERVICE
+      - CHOWN
+      - SETUID
+      - SETGID
+      - DAC_OVERRIDE