release: 2.15.0: server-dmarc-hint, upstream-tls-verify

The server's own name gets a DMARC record on Settings and Health, and an
inbound domain's upstream a Verified TLS mode (Postfix secure, with
Debian's CA bundle). Migration 0014; schema 14. The pins (compose, README,
guide), the guide's backup example, the planned cuts and the two roadmap
rows. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -112,8 +112,8 @@ outbound mail will not reach the real internet without DNS, PTR, and port 25.
 > local image and pulls nothing:
 >
 > ```sh
-> docker build -f build/Dockerfile --build-arg VERSION=2.14.5 \
->   -t ghcr.io/mixeme/selfpost:2.14.5 .
+> docker build -f build/Dockerfile --build-arg VERSION=2.15.0 \
+>   -t ghcr.io/mixeme/selfpost:2.15.0 .
 > ```
 
 ```sh
@@ -122,7 +122,7 @@ docker run --rm -d --name selfpost-try \
   -e SELFPOST_HOSTNAME=mail.local.test \
   -e PANEL_COOKIE_SECURE=false \
   -v selfpost-try-data:/data \
-  ghcr.io/mixeme/selfpost:2.14.5
+  ghcr.io/mixeme/selfpost:2.15.0
 ```
 
 This trial runs with Docker's default capabilities and no