inbound-antispam-panel: three things the reviews left as found

The owner asked for them to be put right (2026-10-12).

  - A refusal is not logged twice after an unclean stop. The tailer
    saves its place every five seconds, so on start it reads some
    lines again; for the lines it reads on start a row is written only
    if the same row is not there already (store.InsertInboundSpamOnce:
    same moment, client, sender, recipient, decision, engine, detail).
    Lines read as they are written are always new, so two identical
    refusals in one second stay two rows.
  - The Inbound log offers Deny / Allow sender only for a sender the
    lists would take (inbound.Listable): an envelope sender may be
    spelt in ways the form refuses, and the link led to a refusal.
  - A network of one address is stored as the address: 192.0.2.7/32
    and 192.0.2.7 were two entries of one list.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/logtail/offset.go

@@ -22,8 +22,8 @@ const (
 	// persistInterval throttles the offset write. Losing up to this much
 	// progress on a crash means re-parsing a few lines, which is much cheaper
 	// than a database write per poll tick. For a delivery status that changes
-	// nothing (UpdateStatus is idempotent); a refusal in those lines gets a
-	// second row in the inbound journal.
+	// nothing (UpdateStatus is idempotent), and a refusal among them is not
+	// written to the inbound journal a second time (inboundJournal.handle).
 	persistInterval = 5 * time.Second
 )
 
@@ -49,7 +49,7 @@ type tracker struct {
 // tail written while the panel was down; anything else means the file is not
 // the one the offset referred to (rotated, recreated or truncated in the
 // meantime), so read it from the start. Re-parsing lines already seen writes
-// the same status onto the same send-log row, and a second inbound journal
+// the same status onto the same send-log row, and no second inbound journal
 // row for a refusal among them.
 func (t *tracker) resume(f *os.File) int64 {
 	size, err := fileSize(f)