Phase 6: journal-milter + send-log status tailer + retention

Implement the structured send log (spec 7.3), the project's highest-risk
component since a milter bug can break the relay itself.

- internal/milter: go-milter v0.4.1 journal-milter. Per-connection session
  collects SASL login, From, recipients and Subject across callbacks and
  writes one send_log "queued" row per (queue-id, recipient) at EOM
  (spec 7.3.3). Monitoring only: callbacks return Continue/Accept, recorder
  errors are logged never propagated, so it can never block mail.
- internal/logtail: polling mail.log tailer with rotation handling (inode
  change / truncation), parses sent/deferred/bounced/expired by queue-id +
  recipient and advances rows; background retention sweep prunes rows past
  SEND_LOG_RETENTION_DAYS (default 90) at startup and every 6h.
- internal/store/sendlog.go: InsertQueued, UpdateStatus (case-insensitive
  recipient match), DeleteSendLogBefore + status constants.
- cmd/panel: open the store once and share it across http/milter/tailer;
  replace the journal/logtail stubs with the real roles.
- build/postfix-config.sh: bounded milter timeouts (15/15/30s) so a hung
  milter also fails open in seconds, not the 300s default.

Fix found in-container: SASL login (app_login) was empty because go-milter
keys macros exactly as Postfix sends them, and multi-character macro names
arrive brace-wrapped ({auth_authen}); the SASL-less Phase 0 spike could not
observe this. Added a brace-tolerant macro lookup.

Verified on selfpost.mixfed.ru: gofmt/vet/unit tests green; container e2e
records rows with correct fields and advances status via the tailer; fail-open
confirmed for both an unreachable and a hung milter; retention prunes at start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -0,0 +1,82 @@
+package store
+
+import (
+	"fmt"
+	"time"
+)
+
+// Send-log status values (spec 7.3). "queued" is written by the journal-milter
+// when a message is accepted; the log-tailer advances it to one of the final
+// states as Postfix reports delivery per recipient.
+const (
+	StatusQueued   = "queued"
+	StatusSent     = "sent"
+	StatusDeferred = "deferred"
+	StatusBounced  = "bounced"
+)
+
+// SendLogEntry is a single queued send-log row. The journal-milter creates one
+// per (queue-id, recipient) pair at end-of-message (spec 7.3.3); every field
+// except the status/timestamps comes from the accepted message.
+type SendLogEntry struct {
+	QueueID  string
+	Domain   string
+	AppLogin string
+	From     string
+	To       string
+	Subject  string
+}
+
+// InsertQueued records an accepted message in the send log with status
+// "queued". It is called from the journal-milter hot path, so it returns any
+// error for the caller to log rather than deciding policy here; the milter must
+// stay fail-open regardless (spec 7.3).
+func (s *Store) InsertQueued(e SendLogEntry) error {
+	now := time.Now().UTC().Format(time.RFC3339)
+	_, err := s.db.Exec(
+		`INSERT INTO send_log
+			(queue_id, domain, app_login, from_addr, to_addr, subject, status, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		e.QueueID, e.Domain, e.AppLogin, e.From, e.To, e.Subject, StatusQueued, now, now,
+	)
+	if err != nil {
+		return fmt.Errorf("insert send_log: %w", err)
+	}
+	return nil
+}
+
+// UpdateStatus advances the delivery status of the send-log rows matching a
+// (queue-id, recipient) pair, which the log-tailer parses out of mail.log.
+// Recipient matching is case-insensitive because Postfix may normalise address
+// case between the milter (envelope) and the delivery log. It returns the
+// number of rows updated so the caller can tell whether the line matched a
+// journal entry.
+func (s *Store) UpdateStatus(queueID, recipient, status string) (int64, error) {
+	now := time.Now().UTC().Format(time.RFC3339)
+	res, err := s.db.Exec(
+		`UPDATE send_log SET status = ?, updated_at = ?
+		 WHERE queue_id = ? AND to_addr = ? COLLATE NOCASE`,
+		status, now, queueID, recipient,
+	)
+	if err != nil {
+		return 0, fmt.Errorf("update send_log status: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}
+
+// DeleteSendLogBefore removes send-log rows created before cutoff, implementing
+// the configurable retention window (spec 7.3, SEND_LOG_RETENTION_DAYS). It
+// returns the number of rows pruned. created_at is stored as RFC3339 UTC, so a
+// lexical comparison against the same format is chronologically correct.
+func (s *Store) DeleteSendLogBefore(cutoff time.Time) (int64, error) {
+	res, err := s.db.Exec(
+		`DELETE FROM send_log WHERE created_at < ?`,
+		cutoff.UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return 0, fmt.Errorf("prune send_log: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	return n, nil
+}