Scan inbound and outbound via the smarthost only, harden rspamd and Valkey

- tag inbound instead of rejecting, keep virus reject and tempfail when ClamAV fails
- score inbound against the first hop before the edge relays
- sign and skip GPT only for smarthost mynetworks sources
- elect the highest-offset Valkey on full restart, cap memory at 384mb
- read a hashed controller password

apps/base/mail/kustomization.yaml

@@ -23,11 +23,16 @@ configMapGenerator:
       - rspamd/actions.conf
       - rspamd/antivirus.conf
       - rspamd/dkim_signing.conf
+      - rspamd/external_relay.conf
+      - rspamd/force_actions.conf
       - rspamd/gpt.conf
       - rspamd/greylist.conf
       - rspamd/history_redis.conf
+      - rspamd/local_networks.map
+      - rspamd/milter_headers.conf
       - rspamd/options.inc
       - rspamd/redis.conf
+      - rspamd/settings.conf
       - rspamd/spamassassin.conf
       - rspamd/worker-controller.inc
       - rspamd/worker-normal.inc