from-header-binding: what the reviews had left as found, and address extensions

The owner on the three things the reviews' commit left as found: can they be
fixed? They can.

- Downtime that crossed a UTC midnight was all booked on the day of the
  restart: it is cut at the midnights between (byDay).
- A message with the null envelope sender - a bounce an application writes
  itself - left a refusal row without a domain, which no domain
  administrator would see: the row takes the domain the login is bound to.
- A log read again after an unclean stop counted its deferrals again: while
  the tailer catches up, a warning no later than the last one counted is
  passed over. The mark is kept to the fraction of a second the log gives.

And on the check being stricter than Postfix for an address with an
extension (invoices+x@ passed in the envelope, was refused in the header):
it makes Postfix's second try now, the address without its extension.
recipient_delimiter was the distribution's default; it is set in
postfix-config.sh, since the check depends on it. e2e sends one through.

Test server, this tree: go vet ok, go test 23 packages ok, make e2e ok (339 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/postfix-config.sh

@@ -203,8 +203,14 @@ postconf -e \
 # Sender binding (the critical anti-spoofing control). texthash resolves the
 # full address first, then the "@domain" wildcard, so both address modes work
 # from the same map.
+#
+# recipient_delimiter is said here and not left to the distribution's main.cf:
+# it is what lets an application listed as invoices@ send as invoices+march@,
+# and the panel's sender check makes the same second try for the From: line
+# (extensionDelimiter in internal/milter/sender.go) - the two must agree.
 postconf -e \
 	"smtpd_sender_login_maps=texthash:${SENDER_LOGIN_MAPS}" \
+	"recipient_delimiter=+" \
 	"queue_directory=${QUEUE_DIR}"
 
 # Restrictions: authenticated clients only, no relay to foreign destinations,