delivery-log-storage: findings of the technical and security reviews

Neither review (read-only agents, Opus and Fable, over ae06d8b..815236a) has
a Critical or High finding. What they found and what was done:

- A stranger on port 25 could grow the table: every queue-id line of inbound
  mail was stored and pruned an hour or more later, his own message-id among
  them. The tailer now leaves out the lines of a queue id that
  postfix/inbound/smtpd opened, until qmgr removes the message or another
  listener opens one under the id; 4096 such ids are remembered.
- A commit, so a disk sync, per stored line on the connection the journal
  milter shares, and a backlog written line by line. Lines are now written in
  one transaction per pass over the log, 500 at most, before the read offset
  is saved (InsertSendLogLines; follow() calls the keeper's flush).
- The prune asked the send log once per line and ran hourly. It asks once per
  queue id and runs at start and with the six-hourly sweep; with port-25 mail
  left out there is little without a row to wait for.
- The 4096-byte cut could split a character; it keeps characters whole.
- security.md did not say that a backup now carries these lines, and the plan
  said the time window excludes a reused queue id where it only limits the
  chance to the row's queue lifetime. Both are corrected; the collision is
  recorded as an accepted risk with its trigger.
- Tests that did not prove their comments: the prune is now tested with the
  sweep, a rejected row next to the prune, batching and the change from
  catching up to following, port-25 mail left out and its id reused.

Left as found and written down in the plan: lines the tailer never reads
(a file rotated away while the panel was down), and a message in the queue
across the upgrade, which shows only its later lines.

On the test server, for this tree: go vet clean, go test ./... 22 packages
ok, make e2e ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/logtail/logtail_test.go

@@ -150,27 +150,31 @@ type captureStore struct {
 
 	// lines are the log lines kept for messages' pages; pruned is the cutoff of
 	// each PruneSendLogLines call.
-	lines  []store.SendLogLine
-	pruned []time.Time
+	lines   []store.SendLogLine
+	batches int
+	pruned  []time.Time
 }
 
-func (c *captureStore) InsertSendLogLine(l store.SendLogLine) error {
+// InsertSendLogLines keeps what the store would: with once, a line is not
+// kept a second time under its queue id. batches counts the calls.
+func (c *captureStore) InsertSendLogLines(lines []store.SendLogLine, once bool) (int, error) {
 	c.mu.Lock()
 	defer c.mu.Unlock()
-	c.lines = append(c.lines, l)
-	return nil
-}
-
-func (c *captureStore) InsertSendLogLineOnce(l store.SendLogLine) (bool, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-	for _, have := range c.lines {
-		if have.QueueID == l.QueueID && have.Line == l.Line {
-			return false, nil
+	c.batches++
+	wrote := 0
+next:
+	for _, l := range lines {
+		if once {
+			for _, have := range c.lines {
+				if have.QueueID == l.QueueID && have.Line == l.Line {
+					continue next
+				}
+			}
 		}
+		c.lines = append(c.lines, l)
+		wrote++
 	}
-	c.lines = append(c.lines, l)
-	return true, nil
+	return wrote, nil
 }
 
 func (c *captureStore) PruneSendLogLines(cutoff time.Time) (int64, error) {