fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/entrypoint.sh

@@ -11,8 +11,10 @@ set -e
 chown panel:panel /data
 # Restored backups or previously-created state may contain panel-owned files
 # under /data; make sure they stay writable without disturbing anything that a
-# later phase deliberately hands to another service.
-find /data -mindepth 1 -maxdepth 1 ! -user panel -exec chown -R panel:panel {} +
+# later phase deliberately hands to another service. /data/log is exempt: it is
+# deliberately owned by postfix (postlogd writes the delivery log there) and is
+# normalised on its own below.
+find /data -mindepth 1 -maxdepth 1 ! -user panel ! -name log -exec chown -R panel:panel {} +
 
 # DKIM key tree (spec 6, 9). The panel (user `panel`) generates keys and writes
 # the OpenDKIM tables; OpenDKIM (user `opendkim`) must read them. Normalise the
@@ -51,6 +53,23 @@ chown -R panel:selfpost /data/postfix
 chmod 2750 /data/postfix
 chmod 0640 /data/postfix/sender_login_maps
 
+# Delivery log (architecture.md § Log tailer). postlogd writes it as user
+# `postfix`; the panel reads it for the log-tailer and the System log page. It
+# lives under /data — not the ephemeral /var/log — so the delivery lines that
+# resolve a "queued" send-log row survive a container recreate.
+#
+# postlogd creates a missing log itself, but at 0600, which the unprivileged
+# panel cannot read; so create it here (and re-normalise an existing one, plus
+# whatever logrotate left behind) at 0640 owned postfix:selfpost. The setgid
+# directory keeps the shared group on anything created inside it later, and
+# 2750 keeps it group-traversable but not group-writable — logrotate refuses to
+# rotate a log whose directory is writable by a non-root group.
+mkdir -p /data/log
+[ -e /data/log/mail.log ] || : > /data/log/mail.log
+chown -R postfix:selfpost /data/log
+chmod 2750 /data/log
+find /data/log -type f -exec chmod 0640 {} +
+
 # Milter socket directories (spec 5 p.3, 7.3). Postfix (user `postfix`) must
 # actually CONNECT to both milter sockets — OpenDKIM's and the panel's
 # journal-milter — not just probe them at start-up. The sockets are