feat(postfix): deploy postfix MTA and rspamd spam filter

- postfix namespace with Deployment + HPA (2-6 replicas)
- rspamd Deployment + HPA (2-6 replicas) with milter interface
- postfix configured to relay inbound mail to stalwart via transport maps
- rspamd milter on port 11332 for spam scanning and DKIM signing
- DKIM keys stored in Vault at kubernetes/namespace/postfix/default/dkim-keys
- TLS cert via cert-manager (vault-issuer) for mail.main.unkin.net
- rspamd web UI exposed via Traefik Gateway at rspamd.k8s.syd1.au.unkin.net
- postfix external LoadBalancer service for inbound MX on port 25
- artifactapi: add boky/postfix and rspamd/rspamd to dockerhub cache

apps/base/postfix/kustomization.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - postfix-deployment.yaml
+  - postfix-hpa.yaml
+  - rspamd-deployment.yaml
+  - rspamd-hpa.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: postfix-config
+    files:
+      - resources/postfix/custom.cf
+    options:
+      disableNameSuffixHash: true
+  - name: postfix-transport
+    files:
+      - transport=resources/postfix/transport
+    options:
+      disableNameSuffixHash: true
+  - name: rspamd-config
+    files:
+      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
+      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
+      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
+    options:
+      disableNameSuffixHash: true