upstream-tls-verify: Verified TLS to an inbound domain's upstream

Owner, 2026-10-18: "Оба предложения делаем"; the mockup is c10cd78. The
security audit's M7: Required is Postfix's encrypt level, which checks no
certificate - it keeps the mail from a listener, not from one who answers
in the upstream's place.

- A fourth TLS mode, Verified, stored as Postfix's level secure (migration
  0014 rebuilds inbound_transports with the wider CHECK; schema 14) and
  written to the TLS policy map like the others. Postfix matches the
  certificate against the next hop's name (smtp_tls_secure_cert_match =
  nexthop, dot-nexthop, the default; postconf(5)), so Verified is refused
  for an upstream given by address (checkSecureHost).
- Postfix's SMTP client trusts Debian's ca-certificates bundle
  (smtp_tls_CAfile): Postfix trusts none by default (DEF_SMTP_TLS_CA_FILE
  "", DEF_TLS_APPEND_DEF_CA 0). The levels may and encrypt only log the
  verdict, so mail to recipients' MX is unchanged.
- The page: the select's fourth option, a help line under it, the lead
  "over verified TLS", the list's tag "verified"; Help word for word with
  the mockup; guide § Inbound relay, with a posttls-finger command to try
  an upstream first.

Tests: TestVerifiedTLSNeedsTheUpstreamsName, TestRenderInboundMapsSecure,
TestUpstreamTLSModeSecure; schema tests at 14. e2e
inbound_upstream_verified_tls: an address refused, a name saved as
"[sink]:25 secure" in tls_policy, the page says verified, the CA file set
and present, and posttls-finger -l secure with it calls the stand's
self-signed port 25 "Untrusted" (the stand has no TLS upstream). make e2e
(65 passed) and go vet + go test (26 packages) on the test server for this
tree. Tried against the live upstream from the 2.14.5 container:
mc-ent.mixfed.ru gives "Verified TLS connection established".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/inbound.go

@@ -24,6 +24,7 @@ func InboundDomainHref(id int64) string { return inboundDomains + "/" + strconv.
 const (
 	recipientModeAny = "any"
 	tlsModeEncrypt   = "encrypt"
+	tlsModeSecure    = "secure"
 	tlsModeNone      = "none"
 )
 
@@ -120,6 +121,8 @@ func tlsTag(mode string) Tag {
 	switch mode {
 	case tlsModeEncrypt:
 		return Tag{Status: "ok", Label: "required"}
+	case tlsModeSecure:
+		return Tag{Status: "ok", Label: "verified"}
 	case tlsModeNone:
 		return Tag{Status: "off", Label: "off"}
 	}
@@ -303,7 +306,7 @@ func NewInDomain(m Meta, in InDomainInput) *InDomain {
 		Host:           in.Host,
 		Port:           strconv.Itoa(in.Port),
 		TLSOptions: []Option{{Value: "may", Label: "Opportunistic"}, {Value: tlsModeEncrypt, Label: "Required"},
-			{Value: tlsModeNone, Label: "Off"}},
+			{Value: tlsModeSecure, Label: "Verified"}, {Value: tlsModeNone, Label: "Off"}},
 		TLSSelected: in.TLSMode,
 
 		Recipients:       Box{No: "03", Title: "Valid recipients", ID: "recipients", Help: topicLink(HelpRecipients, "Listed addresses or any address")},
@@ -335,6 +338,8 @@ func inDomainLead(in InDomainInput) Text {
 	switch in.TLSMode {
 	case tlsModeEncrypt:
 		tls = "over required TLS"
+	case tlsModeSecure:
+		tls = "over verified TLS"
 	case tlsModeNone:
 		tls = "without TLS"
 	}