release: 2.15.0: server-dmarc-hint, upstream-tls-verify

The server's own name gets a DMARC record on Settings and Health, and an
inbound domain's upstream a Verified TLS mode (Postfix secure, with
Debian's CA bundle). Migration 0014; schema 14. The pins (compose, README,
guide), the guide's backup example, the planned cuts and the two roadmap
rows. No tag.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -107,7 +107,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 2. Git tag `vX.Y.Z` and publish the GitHub Release only on explicit request (see
    [§ Release image](#release-image)).
 
-**Planned version cuts** (from pin `2.14.5`; adjust if semver changes mid-track):
+**Planned version cuts** (from pin `2.15.0`; adjust if semver changes mid-track):
 
 | Stage | ID | Cut |
 |---|---|---|
@@ -157,6 +157,7 @@ than the default «meaningful step» rule in [§ Commits and release build](#com
 | 44 | label-tag | `2.14.3` |
 | 45 | security-audit-2026-10-17, stages 0-6 | `2.14.4` |
 | 46 | etrn-silent | `2.14.5` |
+| 47 | server-dmarc-hint, upstream-tls-verify | `2.15.0` |
 
 Docs-only prep (checklists in plans, no product code) uses the same per-step
 commit rule but **no** version cut until the next product stage ships.