docs: add preflight installation-check page plan and roadmap entry

Captures the design for a /preflight page that verifies instance-level infrastructure (rDNS, TLS, ports, HELO banner, proxy headers, DKIM socket, test email). Status: candidate.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/roadmap.md

@@ -28,6 +28,7 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 
 | ID | Topic | Status | Progress | Plan |
 |---|---|---|---|---|
+| preflight | Installation check page (`/preflight`) | candidate | — | [plans/preflight.md](plans/preflight.md) |
 | contributing | `CONTRIBUTING.md` | candidate | — | — |
 | inbound-antispam-panel | Inbound antispam journal + allow/deny lists | agreed | 1/12 | [plans/inbound-antispam-panel.md](plans/inbound-antispam-panel.md) |
 | inbound-quarantine | Inbound spam quarantine (hold / review / release) | candidate | — | [plans/inbound-quarantine.md](plans/inbound-quarantine.md) |
@@ -137,6 +138,30 @@ yet.
 
 ---
 
+## preflight
+
+**Goal:** a `/preflight` page (global-admin only) that verifies instance-level
+infrastructure: rDNS/PTR, TLS certificate + hostname match, port 25/465/587
+reachability, HELO banner correctness, reverse-proxy headers, DKIM milter
+socket, and a test-email sender. Each check shows an actionable fix
+recommendation on failure.
+
+**Boundary:** instance infrastructure only; per-domain DNS checks remain on
+domain detail pages. Does not track test-email delivery beyond local MTA
+acceptance.
+
+**Done when:** the page loads, all checks run with traffic-light results and
+recommendations, and the test-email form successfully submits a message through
+Postfix.
+
+**Dependencies / risks:** port-connectivity check may not reflect external
+reachability behind NAT without hairpin; test email needs at least one domain or
+falls back to `postmaster@SELFPOST_HOSTNAME`.
+
+**Version:** `1.x` MINOR; `candidate`.
+
+---
+
 ## schema-squash
 
 **Goal:** when 2.x is cut, stop shipping the 1.x migration chain in the binary