Phase 6: journal-milter + send-log status tailer + retention

Implement the structured send log (spec 7.3), the project's highest-risk
component since a milter bug can break the relay itself.

- internal/milter: go-milter v0.4.1 journal-milter. Per-connection session
  collects SASL login, From, recipients and Subject across callbacks and
  writes one send_log "queued" row per (queue-id, recipient) at EOM
  (spec 7.3.3). Monitoring only: callbacks return Continue/Accept, recorder
  errors are logged never propagated, so it can never block mail.
- internal/logtail: polling mail.log tailer with rotation handling (inode
  change / truncation), parses sent/deferred/bounced/expired by queue-id +
  recipient and advances rows; background retention sweep prunes rows past
  SEND_LOG_RETENTION_DAYS (default 90) at startup and every 6h.
- internal/store/sendlog.go: InsertQueued, UpdateStatus (case-insensitive
  recipient match), DeleteSendLogBefore + status constants.
- cmd/panel: open the store once and share it across http/milter/tailer;
  replace the journal/logtail stubs with the real roles.
- build/postfix-config.sh: bounded milter timeouts (15/15/30s) so a hung
  milter also fails open in seconds, not the 300s default.

Fix found in-container: SASL login (app_login) was empty because go-milter
keys macros exactly as Postfix sends them, and multi-character macro names
arrive brace-wrapped ({auth_authen}); the SASL-less Phase 0 spike could not
observe this. Added a brace-tolerant macro lookup.

Verified on selfpost.example.com: gofmt/vet/unit tests green; container e2e
records rows with correct fields and advances status via the tailer; fail-open
confirmed for both an unreachable and a hung milter; retention prunes at start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

cmd/panel/journal.go

@@ -0,0 +1,45 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"log"
+	"net"
+	"os"
+	"path/filepath"
+
+	"codeberg.org/mix/selfpost/internal/milter"
+	"codeberg.org/mix/selfpost/internal/store"
+)
+
+// serveJournal opens the journal-milter Unix socket and runs the real milter
+// (spec 7.3), recording accepted messages into the send log. Socket lifecycle
+// (creation, stale cleanup, group permissions) lives here; the protocol handler
+// lives in internal/milter.
+func serveJournal(ctx context.Context, cfg config, st *store.Store) error {
+	socketPath := cfg.journalSocket
+	if err := os.MkdirAll(filepath.Dir(socketPath), 0o755); err != nil {
+		return err
+	}
+	// Clear a stale socket left behind by an unclean shutdown, otherwise the
+	// listen below fails with "address already in use".
+	if err := os.Remove(socketPath); err != nil && !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+
+	ln, err := net.Listen("unix", socketPath)
+	if err != nil {
+		return err
+	}
+	// Postfix (user `postfix`) connects to this socket as a milter and needs
+	// group access. The socket inherits group `selfpost` from the setgid parent
+	// dir entrypoint.sh prepares; make it group read/write so postfix can reach
+	// it (connecting to a Unix socket needs write permission on the node).
+	if err := os.Chmod(socketPath, 0o660); err != nil {
+		ln.Close()
+		return err
+	}
+
+	log.Printf("journal-milter listening on %s", socketPath)
+	return milter.Serve(ctx, ln, st)
+}