inbound-antispam-panel: filter lists, written as rspamd maps

Step 5/12 of docs/plans/inbound-antispam-panel.md.

Store: AddSpamListEntry, ListSpamListEntries, DeleteSpamListEntry.
internal/inbound/lists.go validates and normalises an entry - sender
address, sender domain, client address or network (canonical text, an
IPv4-mapped address as IPv4, /0 refused) - and writes the lists as six
map files under /data/antispam (ANTISPAM_DIR), each atomically, 0644 in
a 0755 directory: the filter is another user in another container. All
six are written on every change and on every start with the relay on,
empty ones included. An entry whose maps could not be written is taken
back out of the table. The writer refuses a stored value with
whitespace, a newline or # in it.

The plan's allow.map / deny.map became one file per list and entry
type: to rspamd an IP map and a sender map are different map types.

deploy/antispam/rspamd/multimap.conf holds the rules; the fragment
mounts it and ./data/antispam into the sidecar. Deny is a prefilter
reject, allow a symbol weighing -100. Tried in a throwaway rspamd 3.11
container on the test server:
  - with allow as a prefilter accept, an address on both lists was
    accepted and an IP on both was refused - the rule that ran first
    decided; with the weight, deny won in all five mixed cases;
  - IPv4, IPv6, address (any case), domain (not its subdomains) match;
  - a rewritten file is reread in about ten seconds, no restart;
  - files that appear after rspamd started are loaded the same way.

No page edits the lists yet (step 6).

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok - with the relay on
/data/antispam is 755 and holds the six maps, 644, empty.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/inboundspam.go

@@ -95,3 +95,86 @@ func (s *Store) IsInboundDomain(name string) (bool, error) {
 	}
 	return true, nil
 }
+
+// Lists and entry kinds of the filter lists. Kept in sync with the CHECK
+// constraints of inbound_spam_list.
+const (
+	SpamListAllow = "allow"
+	SpamListDeny  = "deny"
+
+	SpamEntryAddress = "address" // sender address
+	SpamEntryDomain  = "domain"  // sender domain
+	SpamEntryIP      = "ip"      // client address or network
+)
+
+// ErrSpamListEntryExists is returned when the entry is already on that list.
+var ErrSpamListEntryExists = errors.New("filter list entry already exists")
+
+// ErrSpamListEntryNotFound is returned when a filter list entry id does not exist.
+var ErrSpamListEntryNotFound = errors.New("filter list entry not found")
+
+// SpamListEntry is one allow or deny entry for the external filter. Value is
+// stored normalised by the caller (internal/inbound), which is what makes the
+// uniqueness of an entry on its list mean anything.
+type SpamListEntry struct {
+	ID        int64
+	List      string
+	Kind      string
+	Value     string
+	Note      string
+	CreatedAt time.Time
+}
+
+// AddSpamListEntry inserts an entry. The caller must have validated it.
+func (s *Store) AddSpamListEntry(list, kind, value, note string) (SpamListEntry, error) {
+	now := time.Now().UTC()
+	res, err := s.db.Exec(
+		"INSERT INTO inbound_spam_list (list_type, entry_type, value, note, created_at) VALUES (?, ?, ?, ?, ?)",
+		list, kind, value, note, now.Format(time.RFC3339),
+	)
+	if err != nil {
+		if isUniqueViolation(err) {
+			return SpamListEntry{}, ErrSpamListEntryExists
+		}
+		return SpamListEntry{}, fmt.Errorf("insert inbound_spam_list: %w", err)
+	}
+	id, err := res.LastInsertId()
+	if err != nil {
+		return SpamListEntry{}, fmt.Errorf("filter list entry id: %w", err)
+	}
+	return SpamListEntry{ID: id, List: list, Kind: kind, Value: value, Note: note, CreatedAt: now.Truncate(time.Second)}, nil
+}
+
+// ListSpamListEntries returns every entry of both lists: by list, then kind,
+// then value.
+func (s *Store) ListSpamListEntries() ([]SpamListEntry, error) {
+	rows, err := s.db.Query(
+		"SELECT id, list_type, entry_type, value, note, created_at FROM inbound_spam_list ORDER BY list_type, entry_type, value")
+	if err != nil {
+		return nil, fmt.Errorf("list inbound_spam_list: %w", err)
+	}
+	defer rows.Close()
+	var out []SpamListEntry
+	for rows.Next() {
+		var e SpamListEntry
+		var created string
+		if err := rows.Scan(&e.ID, &e.List, &e.Kind, &e.Value, &e.Note, &created); err != nil {
+			return nil, fmt.Errorf("scan inbound_spam_list: %w", err)
+		}
+		e.CreatedAt, _ = time.Parse(time.RFC3339, created)
+		out = append(out, e)
+	}
+	return out, rows.Err()
+}
+
+// DeleteSpamListEntry removes an entry by id.
+func (s *Store) DeleteSpamListEntry(id int64) error {
+	res, err := s.db.Exec("DELETE FROM inbound_spam_list WHERE id = ?", id)
+	if err != nil {
+		return fmt.Errorf("delete inbound_spam_list: %w", err)
+	}
+	if n, _ := res.RowsAffected(); n == 0 {
+		return ErrSpamListEntryNotFound
+	}
+	return nil
+}