release: 1.4.0: Optional inbound relay (backup-MX) on port 25

Optional inbound relay (backup-MX / forwarder) on port 25, off by default. Mail is accepted only for domains configured in the panel and forwarded to an upstream; there are still no mailboxes. A dedicated security review of the inbound path is still open on the plan (Fable).
Added:
  - `INBOUND_RELAY_ENABLE` (default `false`): when true, Postfix listens on
  - Panel **Inbound** pages (global administrator): domains, upstream host/port
  - Optional `INBOUND_ANTISPAM_MILTER` on the inbound listener only, plus
  - Inbound rate limit (`INBOUND_RATE_LIMIT_MESSAGES_PER_IP`, default 20) and
Changed:
  - Compose publishes host port 25 even when the flag is off (nothing listens
  - Full-backup restore Resync also rebuilds inbound maps when the flag is on.

Full detail: CHANGELOG.md (1.4.0).

internal/web/view/templates/inbound_delete.html

@@ -0,0 +1,20 @@
+{{define "content"}}
+<h1>Delete {{.Domain.Name}}</h1>
+
+{{template "back_link" (back (printf "/inbound/%d" .Domain.ID) (printf "Back to %s" .Domain.Name))}}
+
+<div class="card">
+  <h2>Confirm deletion</h2>
+  <p>You are about to stop accepting inbound mail for <strong>{{.Domain.Name}}</strong>. This will:</p>
+  <ul>
+    <li>remove it from <code>relay_domains</code> and the recipient map;</li>
+    <li>stop forwarding{{if ne .Upstream "—"}} to <strong>{{.Upstream}}</strong>{{end}};</li>
+    <li>leave outbound sending domains untouched.</li>
+  </ul>
+  <p class="muted">This cannot be undone from a backup of inbound maps alone
+  unless you restore one. Remove the MX if you do not plan to re-add the domain.</p>
+  <form method="post" action="/inbound/{{.Domain.ID}}/delete">
+    <button type="submit" class="danger">Delete {{.Domain.Name}}</button>
+  </form>
+</div>
+{{end}}