Phase 6: journal-milter + send-log status tailer + retention

Implement the structured send log (spec 7.3), the project's highest-risk
component since a milter bug can break the relay itself.

- internal/milter: go-milter v0.4.1 journal-milter. Per-connection session
  collects SASL login, From, recipients and Subject across callbacks and
  writes one send_log "queued" row per (queue-id, recipient) at EOM
  (spec 7.3.3). Monitoring only: callbacks return Continue/Accept, recorder
  errors are logged never propagated, so it can never block mail.
- internal/logtail: polling mail.log tailer with rotation handling (inode
  change / truncation), parses sent/deferred/bounced/expired by queue-id +
  recipient and advances rows; background retention sweep prunes rows past
  SEND_LOG_RETENTION_DAYS (default 90) at startup and every 6h.
- internal/store/sendlog.go: InsertQueued, UpdateStatus (case-insensitive
  recipient match), DeleteSendLogBefore + status constants.
- cmd/panel: open the store once and share it across http/milter/tailer;
  replace the journal/logtail stubs with the real roles.
- build/postfix-config.sh: bounded milter timeouts (15/15/30s) so a hung
  milter also fails open in seconds, not the 300s default.

Fix found in-container: SASL login (app_login) was empty because go-milter
keys macros exactly as Postfix sends them, and multi-character macro names
arrive brace-wrapped ({auth_authen}); the SASL-less Phase 0 spike could not
observe this. Added a brace-tolerant macro lookup.

Verified on selfpost.example.com: gofmt/vet/unit tests green; container e2e
records rows with correct fields and advances status via the tailer; fail-open
confirmed for both an unreachable and a hung milter; retention prunes at start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build/postfix-config.sh

@@ -122,6 +122,18 @@ postconf -e \
 	"smtpd_milters={ unix:${OPENDKIM_SOCK}, default_action=tempfail }, { unix:${JOURNAL_SOCK}, default_action=accept }" \
 	"non_smtpd_milters="
 
+# Bounded milter timeouts (spec 7.3): a *hung* milter (socket accepts but never
+# replies) must fail open just like a crash, not stall mail acceptance until the
+# Postfix defaults (300s content) elapse. With default_action per milter, a
+# journal-milter hang then resolves to accept and an OpenDKIM hang to tempfail,
+# but within seconds rather than minutes. Values are well above any healthy
+# response time (signing/DB insert are sub-second), so they never fire in normal
+# operation.
+postconf -e \
+	"milter_connect_timeout=${MILTER_CONNECT_TIMEOUT:-15s}" \
+	"milter_command_timeout=${MILTER_COMMAND_TIMEOUT:-15s}" \
+	"milter_content_timeout=${MILTER_CONTENT_TIMEOUT:-30s}"
+
 # --- master.cf: inbound submission services ----------------------------------
 # smtps (465, implicit/wrapper TLS) — the primary, always-on submission service
 # (spec 5 p.1). chroot=n so smtpd can read the sasldb2 and sender map under /data