fix(logtail): keep mail.log in /data and reconcile stuck rows (v1.x closure phase 2)

Move the delivery log from the ephemeral /var/log to /data/log/mail.log so
the lines that resolve a queued send-log row survive a container recreate.
postlogd writes it as postfix, the panel reads it through the selfpost group
(dir 2750, file 0640, normalised every start); backups exclude log/.

Close the residual gap with a queue sweep: rows queued for over two minutes
whose id postqueue -p no longer lists are marked bounced. The sweep waits
until the tailer has read the log to its end and does nothing when the queue
cannot be listed, so a message in flight is never touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/panel/envdoc_test.go

@@ -82,6 +82,7 @@ var buildScriptKeys = []string{
 	"RATE_LIMIT_WINDOW_SECONDS",
 	"OPENDKIM_SOCKET",
 	"JOURNAL_MILTER_SOCKET",
+	"MAIL_LOG",
 	"POSTFIX_SENDER_LOGIN_MAPS",
 	"SASL_DB_PATH",
 	"SUBMISSION_ENABLE",

cmd/panel/main.go

@@ -81,7 +81,10 @@ func loadConfig() config {
 	return config{
 		httpAddr:      envDefault("PANEL_HTTP_ADDR", ":8080"),
 		journalSocket: envDefault("JOURNAL_MILTER_SOCKET", "/run/selfpost/journal.sock"),
-		mailLog:       envDefault("MAIL_LOG", "/var/log/mail.log"),
+		// Postfix's delivery log, under /data so the lines that resolve a
+		// "queued" send-log row outlive the container. The default must match
+		// maillog_file in build/postfix-config.sh.
+		mailLog: envDefault("MAIL_LOG", "/data/log/mail.log"),
 		// Send-log retention window (architecture.md § Persistence).
 		// Non-positive/invalid falls back to the 90-day default inside the
 		// log-tailer.