feat(postfix): deploy postfix MTA and rspamd spam filter

- postfix namespace with Deployment + HPA (2-6 replicas)
- rspamd Deployment + HPA (2-6 replicas) with milter interface
- postfix configured to relay inbound mail to stalwart via transport maps
- rspamd milter on port 11332 for spam scanning and DKIM signing
- DKIM keys stored in Vault at kubernetes/namespace/postfix/default/dkim-keys
- TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net
- rspamd web UI exposed via Traefik Gateway at rspamd.k8s.syd1.au.unkin.net
- postfix external LoadBalancer service for inbound MX on port 25
- artifactapi: add boky/postfix and rspamd/rspamd to dockerhub cache

apps/base/postfix/certificate.yaml

@@ -0,0 +1,21 @@
+---
+# TLS certificate for postfix SMTP - stored in Vault and synced via VaultStaticSecret
+# The postfix-tls secret is managed via vaultstaticsecret.yaml (keys: tls.crt, tls.key)
+# This Certificate resource issues the cert used by Stalwart for SMTP/IMAP TLS
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postfix-smtp-tls
+  namespace: postfix
+spec:
+  secretName: postfix-smtp-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+    - smtp-in.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA