fix(mail): scope outbound-relay TLS to the relay transport

[santhiprakash]

Summary

Stop setting smtp_tls_security_level=encrypt globally in configureOutboundRelay; that forces TLS on the local smtp-amavis delivery to 127.0.0.1:10024, which does not speak TLS, causing all inbound mail to be silently deferred.

Motivation

Reported in #392. apps/api/src/modules/mail/admin/outbound-relay.service.ts uses postconf -e smtp_tls_security_level=encrypt whenever an outbound relay is enabled. smtp_tls_security_level is a global Postfix client directive, so it also applies to the smtp-amavis transport and any other local SMTP client delivery. Amavis on 127.0.0.1:10024 does not offer STARTTLS, so Postfix logs status=deferred (TLS is required, but was not offered by host 127.0.0.1...) and inbound mail never arrives.

Related issue

Fixes #392

Changes

• apps/api
  • outbound-relay.service.ts:
    • Write a per-destination /etc/postfix/tls_policy map ([<host>]:<port> encrypt) and reference it via smtp_tls_policy_maps.
    • Change the global smtp_tls_security_level from encrypt to may.
    • For port 465, still add smtp_tls_wrappermode=yes globally, but pin the smtp-amavis/unix transport to smtp_tls_wrappermode=no via postconf -P.
    • Pin smtp-amavis/unix to smtp_tls_security_level=none via postconf -P.
    • On disableOutboundRelay, remove smtp_tls_policy_maps and smtp_tls_wrappermode, reset smtp_tls_security_level=may, and delete the tls_policy map files.
  • outbound-relay.service.test.ts: add/extend assertions for the tls_policy map, the may security level, the Amavis per-transport overrides, the port-465 wrapper-mode split, and disable cleanup.
• apps/email/engine/samples/postfix/master.cf: add -o smtp_tls_security_level=none and -o smtp_tls_wrappermode=no to the smtp-amavis transport so the sample config matches the runtime override.

Verification

python3 /home/ubuntu/Projects/open-source/scripts/preflight_ship.py \
  --repo oblien/openship --local openship --branch main --issue 392 \
  --file apps/api/src/modules/mail/admin/outbound-relay.service.ts \
  --must-contain 'smtp_tls_security_level=encrypt' \
  --must-not-contain 'smtp_tls_policy_maps'
# PREFLIGHT CLEAR

bun run --cwd apps/api test outbound-relay.service.test.ts
# ✓ src/modules/mail/admin/outbound-relay.service.test.ts (18 tests)

bun run --cwd apps/api lint
# tsc --noEmit (pass)

The targeted test includes new assertions that fail against the original code (which emits smtp_tls_security_level=encrypt and no smtp_tls_policy_maps / no Amavis override).

Screenshots

N/A — backend Postfix config change only.

Checklist

• One change per PR — one bug, or one agreed feature, with nothing unrelated bundled in
• The diff is scoped — no reformatting or lint fixes on lines I wasn't otherwise changing
• A test fails without this change and passes with it (or I explained above why there isn't one)
• bun run test, bun run --cwd <workspace> lint, and bun format all pass locally
• I understand every line of this diff and can explain it in review

Note on the unchecked box: bunx prettier --check on the two touched apps/api files reports pre-existing formatting issues (long lines) unrelated to this change; running bun format would reformat many lines I didn't touch, so I scoped the diff to the functional change. bun run --cwd apps/api lint and the targeted test pass.