feat(deploy): 支持配置邮件客户端 TLS 证书

- 新增 `LANQIN_TLS_CERT_FILE` 和 `LANQIN_TLS_KEY_FILE`，让 Postfix 与 Dovecot 使用外部证书。
- 在单容器与分服务启动脚本中统一回退到 `localhost` 自签证书，并在证书不可读时给出告警。
- 补充部署文档与示例配置，说明第三方客户端校验证书的挂载方式。

deploy/postfix/entrypoint.sh

@@ -1,8 +1,22 @@
 #!/bin/sh
 set -eu
 : "${LANQIN_PUBLIC_HOSTNAME:=mail.example.com}"
+: "${LANQIN_TLS_CERT_FILE:=}"
+: "${LANQIN_TLS_KEY_FILE:=}"
+TLS_CERT=/etc/ssl/certs/ssl-cert-snakeoil.pem
+TLS_KEY=/etc/ssl/private/ssl-cert-snakeoil.key
+if [ -n "$LANQIN_TLS_CERT_FILE" ] || [ -n "$LANQIN_TLS_KEY_FILE" ]; then
+  if [ -f "$LANQIN_TLS_CERT_FILE" ] && [ -f "$LANQIN_TLS_KEY_FILE" ]; then
+    TLS_CERT="$LANQIN_TLS_CERT_FILE"
+    TLS_KEY="$LANQIN_TLS_KEY_FILE"
+  else
+    echo "warning: LANQIN_TLS_CERT_FILE/LANQIN_TLS_KEY_FILE not readable; using snakeoil localhost certificate" >&2
+  fi
+fi
 postconf -e "myhostname = ${LANQIN_PUBLIC_HOSTNAME}"
 postconf -e "myorigin = ${LANQIN_PUBLIC_HOSTNAME}"
+postconf -e "smtpd_tls_cert_file = ${TLS_CERT}"
+postconf -e "smtpd_tls_key_file = ${TLS_KEY}"
 postconf -e "milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}"
 postconf -e "smtpd_milters = inet:rspamd:11332"
 postconf -e "non_smtpd_milters = inet:rspamd:11332"