docs: the upstream's Required TLS checks no certificate (audit M7)

Security audit 2026-10-17, finding M7 (low), stage 6; Help's mockup is
c09368c. postfix/inbound.go writes "encrypt" for Required, and Postfix
verifies no certificate at that level: a domain user who chooses it gets
privacy against passive observers only. The guide § Inbound relay and Help
(word for word with the mockup) say so. Offering "secure" with the
upstream's name is a choice for domain users and hours of work: it goes on
the roadmap as a proposal, not into this plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -98,6 +98,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   three `dmarc_*` maps root creates at the start were missing from the list
   of paths where a symbolic link is removed first.
 
+### Documentation
+
+- **The upstream's "Required" TLS checks no certificate**, and the guide and
+  Help now say so (audit M7): it guards against a listener, not against one
+  who answers in the upstream's place.
+
+
 ## [2.14.3] - 2026-10-17
 
 A tag beside a label. No migration; schema 13.