e2e: the run ends on port 25, with a report, junk and inbound mail

Until now the suite only read back the configuration generated for the
two optional port-25 features. DMARC ingest shipped in 1.7.0 with a
delivery service Postfix could not start, and nothing sent a report
through it until a real one arrived on the test server on 2026-10-11.

The last steps recreate the container with INBOUND_RELAY_ENABLE and
DMARC_REPORTS_ENABLE on, over the same /data, and talk to port 25 as a
stranger's mail server:

- the container log has no postconf warning, the session survives;
- a domain takes the SelfPost-hosted report address; a gzip report
  mailed to it appears under Outbound > DMARC reports; an address nobody
  chose is refused at RCPT;
- a report on another domain and a message with no report are accepted,
  dropped with "dropped: ..." on their delivery lines, counted as two
  parse failures, absent from the queue and from the reports;
- an inbound domain with the sink as upstream and one listed recipient:
  mail for it reaches the sink, another recipient and another domain are
  refused at RCPT.

The stage directory now holds docker-compose.yml and .env, as an
operator's project directory does (a full backup needs them; the
restore scenario that uses it is not in this commit - the panel's full
backup turned out not to work, see the next one).

make e2e on the test server: ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/stage.go

@@ -39,6 +39,9 @@ func prepareStage(s *stack) error {
 	); err != nil {
 		return err
 	}
+	if err := writeDeployFiles(s); err != nil {
+		return err
+	}
 	corefile, err := os.ReadFile(filepath.Join("dns", "Corefile"))
 	if err != nil {
 		return fmt.Errorf("read Corefile: %w", err)
@@ -49,6 +52,22 @@ func prepareStage(s *stack) error {
 	return writeZone(s.stageDir, nil)
 }
 
+// writeDeployFiles puts docker-compose.yml and .env into the stage directory.
+// The stage directory is what the container sees as /selfpost-deploy, the
+// operator's project directory, and a full backup refuses to run unless both
+// files are there to be archived. compose reads neither: the stand names its
+// files with -f, and the .env repeats what compose is given anyway.
+func writeDeployFiles(s *stack) error {
+	compose, err := os.ReadFile(s.baseComposeFile)
+	if err != nil {
+		return fmt.Errorf("read the shipped compose file: %w", err)
+	}
+	if err := os.WriteFile(filepath.Join(s.stageDir, "docker-compose.yml"), compose, 0o644); err != nil {
+		return err
+	}
+	return os.WriteFile(filepath.Join(s.stageDir, ".env"), []byte("SELFPOST_HOSTNAME="+selfpostHostname+"\n"), 0o644)
+}
+
 // removeAllBestEffort deletes path; if a previous run left container-UID files
 // on the bind mount, a root alpine one-shot removes them first.
 func removeAllBestEffort(path string) error {