refactor(mail): 统一邮件认证策略请求与返回格式。

- 将 `auth-policy` 调整为读取 `login`、`remote` 等字段，并返回数值型 `status`。
- 支持按邮箱定位用户与邮箱箱体，补充 IMAP/POP3 认证策略校验。
- 更新 Dovecot 与 Postfix 配置，移除原有的发件人 BCC 依赖。
- 补充相关测试并同步部署说明。

apps/api/internal/app/app_test.go

@@ -814,6 +814,29 @@ func TestAdminSMTPTestEndpoint(t *testing.T) {
 	}
 }
 
+func TestAuthPolicyDovecotResponseFormat(t *testing.T) {
+	a := newTestApp(t)
+	ts := httptest.NewServer(a.Router())
+	defer ts.Close()
+	client := &testClient{t: t, server: ts}
+
+	var allowed map[string]any
+	if code := client.do("POST", "/auth-policy?command=allow", map[string]string{"login": "admin@lanqin.local", "protocol": "smtp"}, &allowed); code != http.StatusOK {
+		t.Fatalf("auth policy allow code=%d body=%v", code, allowed)
+	}
+	if allowed["status"] != float64(0) {
+		t.Fatalf("expected numeric allow status 0, got %#v", allowed["status"])
+	}
+
+	var denied map[string]any
+	if code := client.do("POST", "/auth-policy?command=allow", map[string]string{"login": "missing@lanqin.local", "protocol": "imap"}, &denied); code != http.StatusOK {
+		t.Fatalf("auth policy deny code=%d body=%v", code, denied)
+	}
+	if denied["status"] != float64(-1) {
+		t.Fatalf("expected numeric deny status -1, got %#v", denied["status"])
+	}
+}
+
 func TestProfileAndPasswordUpdate(t *testing.T) {
 	a := newTestApp(t)
 	ts := httptest.NewServer(a.Router())