inbound-antispam-panel: three things the reviews left as found

The owner asked for them to be put right (2026-10-12).

  - A refusal is not logged twice after an unclean stop. The tailer
    saves its place every five seconds, so on start it reads some
    lines again; for the lines it reads on start a row is written only
    if the same row is not there already (store.InsertInboundSpamOnce:
    same moment, client, sender, recipient, decision, engine, detail).
    Lines read as they are written are always new, so two identical
    refusals in one second stay two rows.
  - The Inbound log offers Deny / Allow sender only for a sender the
    lists would take (inbound.Listable): an envelope sender may be
    spelt in ways the form refuses, and the link led to a refusal.
  - A network of one address is stored as the address: 192.0.2.7/32
    and 192.0.2.7 were two entries of one list.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/logtail/logtail.go

@@ -127,7 +127,13 @@ func Run(ctx context.Context, path string, st StatusStore, retention RetentionDa
 
 	return follow(ctx, path, &tracker{st: st, path: path}, caughtUp, func(line string) {
 		if journal != nil {
-			journal.handle(line, time.Now().UTC())
+			catchingUp := true
+			select {
+			case <-caughtUp:
+				catchingUp = false
+			default:
+			}
+			journal.handle(line, time.Now().UTC(), catchingUp)
 		}
 		queueID, recipient, status, ok := parseDelivery(line)
 		if !ok {