refactor(mailgateway): rename namespace postfix→mailgateway, switch to tozd/postfix

- Rename apps/base/postfix → apps/base/mailgateway
- Rename apps/overlays/au-syd1/postfix → apps/overlays/au-syd1/mailgateway
- Namespace postfix → mailgateway throughout all resources
- Replace boky/postfix with tozd/postfix:alpine-322 (Postfix 3.10.2 on Alpine 3.22)
- Add full main.cf and master.cf as ConfigMap resources mounted via subPath
  - main.cf: relay-only gateway config, texthash: transport maps, rspamd milter
  - master.cf: standard smtp + submission (587, TLS required) + internal processes
- Remove custom.cf (superseded by main.cf); merge transport into postfix-config ConfigMap
- MAILNAME/MY_NETWORKS/MY_DESTINATION env vars kept in sync with main.cf
- LOG_TO_STDOUT=1 for k8s log collection
- Vault DKIM keys now at kubernetes/namespace/mailgateway/default/dkim-keys
- artifactapi: replace boky/postfix with tozd/postfix in dockerhub cache

apps/base/mailgateway/gateway.yaml

@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: rspamd
+  namespace: mailgateway
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rspamd-tls
+        mode: Terminate