release: 1.4.0: Optional inbound relay (backup-MX) on port 25

Optional inbound relay (backup-MX / forwarder) on port 25, off by default. Mail is accepted only for domains configured in the panel and forwarded to an upstream; there are still no mailboxes. A dedicated security review of the inbound path is still open on the plan (Fable).
Added:
  - `INBOUND_RELAY_ENABLE` (default `false`): when true, Postfix listens on
  - Panel **Inbound** pages (global administrator): domains, upstream host/port
  - Optional `INBOUND_ANTISPAM_MILTER` on the inbound listener only, plus
  - Inbound rate limit (`INBOUND_RATE_LIMIT_MESSAGES_PER_IP`, default 20) and
Changed:
  - Compose publishes host port 25 even when the flag is off (nothing listens
  - Full-backup restore Resync also rebuilds inbound maps when the flag is on.

Full detail: CHANGELOG.md (1.4.0).

cmd/panel/main.go

@@ -79,6 +79,8 @@ type config struct {
 	saslRealm  string
 	postfixDir string
 	deployRoot string
+
+	inboundEnabled bool
 }
 
 func loadConfig() config {
@@ -140,6 +142,8 @@ func loadConfig() config {
 		saslRealm:  saslRealm(),
 		postfixDir: envDefault("POSTFIX_DIR", filepath.Join(dataDir, "postfix")),
 		deployRoot: envDefault("SELFPOST_DEPLOY_ROOT", "/selfpost-deploy"),
+		// Optional inbound relay (backup-MX / forwarder). Off unless exactly "true".
+		inboundEnabled: os.Getenv("INBOUND_RELAY_ENABLE") == "true",
 	}
 }