inbound-antispam-panel: migration 0002, journal and filter-list tables

Step 2/12 of docs/plans/inbound-antispam-panel.md, the first migration
after the 2.0 baseline (2.0.1 was cut before it, as agreed).

0002_inbound_spam_log.sql adds inbound_spam_log (one row per recipient:
domain, client IP, envelope, subject, decision, engine, detail) with
indexes on created_at and (inbound_domain, created_at), and
inbound_spam_list (allow / deny entries, unique per list). DDL only;
decision, engine, list_type and entry_type carry CHECKs, as the
baseline does for its own enumerations. Nothing reads or writes the
tables yet.

Tests: TestBaselineSchema pins both tables and user_version 2;
TestOpenMigratesA20Database opens a file holding the baseline alone and
finds its user kept; TestInboundSpamConstraints.

go test ./internal/store/ ok; go vet ./... ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -531,16 +531,17 @@ full backups also archive the operator's `./certs` PEM files when present.
 
 ### Database
 
-The schema is one embedded baseline, `internal/store/migrations/0001_init.sql`,
-applied by `store.Open` into an empty file; `PRAGMA user_version` is `1` and
+The schema is an embedded baseline, `internal/store/migrations/0001_init.sql`,
+and the migrations after it (`0002_inbound_spam_log.sql`), applied by
+`store.Open` in file order; `PRAGMA user_version` counts the files applied and
 `PRAGMA application_id` is `0x53503230` ("SP20"). There is no 1.x migration
 chain. **2.0 starts from an empty data directory:** a database with a schema
 version but without the 2.x `application_id` — what every 1.x file looks like —
 is refused at start with `ErrForeignSchema` and left untouched, as is one whose
 version is newer than the build knows. A restored 1.x backup fails the same
 way. Domains are carried across with a domain export, whose format is not the
-database. Later schema changes are new files (`0002_*.sql`, …); once `2.0.0` is
-released the baseline is never edited. History and the per-table list:
+database. A schema change is a new file; the baseline has not been edited
+since `2.0.0`. History and the per-table list:
 [schema-migrations.md](schema-migrations.md).
 
 The tables that carry the panel's model:

docs/plans/inbound-antispam-panel.md

@@ -243,7 +243,7 @@ Target version cut: **`2.1.0`** (MINOR), after `2.0.0`. One commit per step;
 [development.md](../development.md) § Plan checklists.
 
 - [x] Agree journal fields, retention, and RBAC (this plan § Decisions) — **Composer**
-- [ ] Migration `0002_inbound_spam_log.sql` on the 2.0 baseline — **Composer**
+- [x] Migration `0002_inbound_spam_log.sql` on the 2.0 baseline — **Composer**
 - [ ] Inbound journal-milter + Postfix wiring — **Composer**
 - [ ] mail.log tailer: inbound reject rows — **Composer**
 - [ ] List CRUD + validation + atomic rspamd map sync — **Composer**

docs/roadmap.md

@@ -30,7 +30,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 |---|---|---|---|---|
 | preflight | Installation check page (`/preflight`) | candidate | — | [plans/preflight.md](plans/preflight.md) |
 | contributing | `CONTRIBUTING.md` | candidate | — | — |
-| inbound-antispam-panel | Inbound antispam journal + allow/deny lists | agreed | 1/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) |
+| inbound-antispam-panel | Inbound antispam journal + allow/deny lists | in progress | 2/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) |
 | inbound-quarantine | Inbound spam quarantine (hold / review / release) | candidate | — | [plans/inbound-quarantine.md](plans/inbound-quarantine.md) |
 | csrf-tokens | Per-session CSRF tokens on state-changing forms | candidate | — | — |
 | template-data-typing | Typed structs for template data instead of `map[string]any` | candidate | — | — |

docs/schema-migrations.md

@@ -17,8 +17,8 @@ When you add or review a migration, update this file in the same change.
 
 | Field | Value |
 |---|---|
-| Chain head | `user_version = 1` |
-| Files | `0001_init.sql` (the 2.0 baseline) |
+| Chain head | `user_version = 2` |
+| Files | `0001_init.sql` (the 2.0 baseline), `0002_inbound_spam_log.sql` |
 | File mark | `PRAGMA application_id = 0x53503230` ("SP20") |
 | Database file | `/data/selfpost.db` (bind mount) |
 | Compatibility | 2.x MINOR releases must boot a `2.0.0` data directory. **Nothing is carried over from 1.x.** |
@@ -60,10 +60,9 @@ What that means in practice:
 
 **Implication:** once `2.0.0` is released, `0001_init.sql` is never edited
 again and no file is deleted, renamed or reordered — every 2.x database has
-already run it. Until that release the baseline is still being written:
-later steps of the redesign and the features queued behind it (the next one
-is `0002_inbound_spam_log.sql` of inbound-antispam-panel, `2.1.0`) add files
-after it.
+already run it. `2.0.0` and `2.0.1` shipped with the baseline alone; the
+features after them add files, the first being `0002_inbound_spam_log.sql` of
+inbound-antispam-panel (`2.1.0`).
 
 ---
 
@@ -72,13 +71,14 @@ after it.
 | Ver | File | Shipped | Kind | Summary |
 |-----|------|---------|------|---------|
 | 1 | `0001_init.sql` | 2.0.0 | DDL | The whole 2.0 schema, below |
+| 2 | `0002_inbound_spam_log.sql` | 2.1.0 (unreleased) | DDL | `inbound_spam_log`, `inbound_spam_list` and two indexes; nothing existing changes |
 
 **Kind:** *DDL* — schema only; *data* — `INSERT`/`UPDATE` that must stay correct
 for operators upgrading from older 2.x images.
 
 ---
 
-## Schema at head (v1)
+## Schema at head (v2)
 
 | Table | Role |
 |-------|------|
@@ -98,9 +98,12 @@ for operators upgrading from older 2.x images.
 | `user_inbound_domains` | Inbound domains assigned to a `domain` user — granted separately from the outbound ones |
 | `dmarc_reports` | Parsed aggregate report summaries |
 | `dmarc_report_records` | Per-source rows inside a report |
+| `inbound_spam_log` | Inbound antispam journal: one row per recipient of a message offered on port 25, with the decision (`accept`, `reject`, `tempfail`, `quarantine`) and who made it (`rspamd`, `postfix`, `selfpost`). Metadata only (v2) |
+| `inbound_spam_list` | Allow / deny entries for the external filter (`address`, `domain`, `ip`), instance-wide; unique per list (v2) |
 
 `TestBaselineSchema` (`internal/store/schema_test.go`) pins every table, column
-and index of this list.
+and index of this list; `TestOpenMigratesA20Database` opens a database that
+holds the baseline alone.
 
 ### What changed against the last 1.x schema
 
@@ -129,7 +132,7 @@ for the domain. Nothing refers to a user: deleting one changes no domain.
 
 1. Add `internal/store/migrations/00NN_short_name.sql` (next number).
 2. Update the table in [Migration chain](#migration-chain), the snapshot at the
-   top, and the affected rows of [Schema at head](#schema-at-head-v1).
+   top, and the affected rows of [Schema at head](#schema-at-head-v2).
 3. Update `TestBaselineSchema` if tables, columns or indexes change, and add a
    test that opens a database at the previous version and migrates it.
 4. A *data* migration states in a comment which 2.x versions it is written for.