feat: implement B.2 — rotate mail.log by rename + postfix reload

Replaces copytruncate with rename + `postfix reload` (the same mechanism
`postfix logrotate` itself uses), closing the up-to-one-second window where
copytruncate could drop in-flight delivery lines and leave a send-log row
stuck at "queued" forever.

logrotate-mail.conf keeps `create 0644 root root` rather than `nocreate` as
originally planned: verified on a live container that Postfix recreates the
file itself only lazily, on the next write after reload, and at mode 0600 —
unreadable by the unprivileged panel process. `create` hands the file back at
0644 immediately after rename, before Postfix ever touches it.

logtail.follow() re-drains the old file descriptor once more right before
switching to the rotated file, closing the residual gap between the last
poll's drain and the rotation check. readLogTail() treats a momentarily
missing mail.log as an empty screen rather than a logged error.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/logtail/logtail.go

@@ -245,8 +245,11 @@ func follow(ctx context.Context, path string, handle func(string)) error {
 			}
 			pos, _ := f.Seek(0, io.SeekCurrent)
 			if !os.SameFile(info, ni) || ni.Size() < pos {
-				// Rotated away or truncated: reopen from the start of the new
-				// file. Any tail of the old file was already drained above.
+				// Rotated away or truncated: the old (renamed) inode may have
+				// gained lines between the drain() above and this check, since
+				// Postfix keeps writing to it until it reloads. Drain it once
+				// more before switching so nothing in that gap is lost.
+				drain()
 				if err := openAt(0, io.SeekStart); err != nil {
 					log.Printf("log-tailer: reopen %s: %v", path, err)
 				}