fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

build/logrotate-loop.sh

@@ -1,13 +1,13 @@
 #!/bin/sh
-# Periodic logrotate for /var/log/mail.log (spec 9, 10). Rotation renames the
-# file, recreates it (`create 0644 root root`, matching a cold container
+# Periodic logrotate for /data/log/mail.log (spec 9, 10). Rotation renames the
+# file, recreates it (`create 0640 postfix selfpost`, matching a cold container
 # start), then runs `postfix reload` (the same mechanism `postfix logrotate`
 # uses): postlogd keeps writing to the renamed inode until reload, and the
 # panel's log-tailer holds its own descriptor on that inode, so nothing
 # written before the reload is lost. `create` (rather than `nocreate`) matters
-# here beyond timing: a reload-triggered recreate lands the file at 0600,
-# which the unprivileged panel process cannot read — confirmed on a live
-# container — so logrotate must be the one to create it at 0644.
+# here beyond timing: a postlogd-triggered recreate lands the file at 0600
+# owned by postfix, which the unprivileged panel process cannot read —
+# confirmed on a live container — so logrotate must be the one to create it.
 #
 # logrotate itself only rotates once the configured "daily" period has elapsed
 # (tracked in /var/lib/logrotate/status), so it is safe to invoke this more