chore(deploy): 将 DKIM 组件切换为 Rspamd

- 用 Rspamd 替换 OpenDKIM 及其相关镜像、编排和启动脚本。
- 调整 Postfix、单容器镜像与 Docker 配置，改为对接 Rspamd milter。
- 增加 DKIM 私钥同步脚本与 Rspamd 本地配置，支持从 SQLite 周期导出签名密钥。
- 更新 API 启动与测试逻辑，兼容新的默认管理员邮箱与邮箱加载方式。

apps/api/internal/app/app.go

@@ -294,9 +294,32 @@ func (a *App) migrate(ctx context.Context) error {
 	if err := a.migrateMailRulesBuilder(ctx); err != nil {
 		return err
 	}
+	if err := a.migrateLegacyBootstrapMailbox(ctx); err != nil {
+		return err
+	}
 	return nil
 }
 
+func (a *App) migrateLegacyBootstrapMailbox(ctx context.Context) error {
+	adminEmail := normalizeEmail(a.cfg.AdminEmail)
+	if adminEmail == "" || !strings.Contains(adminEmail, "@") {
+		return nil
+	}
+	now := time.Now().UTC().Format(time.RFC3339Nano)
+	_, err := a.db.ExecContext(ctx, `
+		UPDATE mailboxes
+		SET status='disabled', updated_at=?
+		WHERE address=?
+		  AND display_name='LanQin Admin'
+		  AND EXISTS (
+			SELECT 1 FROM users
+			WHERE users.id=mailboxes.user_id
+			  AND users.email=?
+			  AND users.role='admin'
+		  )`, now, adminEmail, adminEmail)
+	return err
+}
+
 func (a *App) migrateMailRulesBuilder(ctx context.Context) error {
 	rows, err := a.db.QueryContext(ctx, `PRAGMA table_info(mail_rules)`)
 	if err != nil {
@@ -533,32 +556,21 @@ func (a *App) seed(ctx context.Context) error {
 		return nil
 	}
 
-	domainName := strings.Split(a.cfg.AdminEmail, "@")[1]
-	domainID, err := a.createDomainTx(ctx, nil, domainName)
-	if err != nil {
-		return err
-	}
-
 	passwordHash, err := bcrypt.GenerateFromPassword([]byte(a.cfg.AdminPassword), bcrypt.DefaultCost)
 	if err != nil {
 		return err
 	}
 	now := a.now().UTC().Format(time.RFC3339Nano)
 	userID := newID("usr")
+	adminEmail := normalizeEmail(a.cfg.AdminEmail)
+	if adminEmail == "" || !strings.Contains(adminEmail, "@") {
+		return errors.New("invalid admin email")
+	}
 	_, err = a.db.ExecContext(ctx, `INSERT INTO users(id,email,display_name,role,password_hash,disabled,created_at,updated_at)
 		VALUES(?,?,?,?,?,?,?,?)`, userID, a.cfg.AdminEmail, "LanQin Admin", "admin", string(passwordHash), 0, now, now)
 	if err != nil {
 		return err
 	}
-
-	local := strings.Split(a.cfg.AdminEmail, "@")[0]
-	mailboxID, err := a.createMailbox(ctx, userID, domainID, local, "LanQin Admin", a.cfg.AdminPassword, 2048, "active")
-	if err != nil {
-		return err
-	}
-	if err := a.seedWelcomeMessage(ctx, mailboxID); err != nil {
-		return err
-	}
 	a.log.Warn("created default administrator; change LANQIN_ADMIN_PASSWORD in production", "email", a.cfg.AdminEmail)
 	return nil
 }