Feat/mail all members (#55)

* feat(mail): give every verified member a free @bbs.profullstack.com mailbox

Email was built but paid-only (Founding Lifetime gate) and never wired to a
running backend. Make it a free benefit of membership and split the address
domain from the mail-server host.

- internal/mailu: Mailu admin-API client; EnsureUser idempotently provisions a
  mailbox via the loopback admin REST API (token = mailu.env API_TOKEN).
- main.go: auto-provision <name>@<mailDomain> at join@ verification and on first
  Mail open; un-gate the Mail hub entry + mail@ (membership/email-verified, not
  Premium); address domain (AGENTBBS_MAIL_ADDR_DOMAIN, default the BBS host) is
  now distinct from the mail server host (AGENTBBS_MAIL_DOMAIN) and the webmail
  URL. Drop the forwardemail alias path (Mailu now owns delivery for everyone).
- mailbox: gate on membership (a registered handle) instead of Paid;
  ErrNotPaid -> ErrNotMember.
- join@ copy: list email under free membership; premium now pitches custom
  domains + Tor only.
- setup.sh / docs/mail.md / deploy/mailu: address-domain vs server-host split,
  Mailu API token, MX for the address domain, local-relay SMTP for verify codes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(mailu): pin Docker network subnet to match SUBNET; ignore runtime state

The base compose declares no network, so Docker assigns the default bridge an
arbitrary subnet that won't match mailu.env SUBNET — breaking Mailu's internal
service auth/relay. Add a docker-compose.override.yml.example that pins the
default network to 192.168.203.0/24, and gitignore the live override + Mailu
runtime state (mailu.env, certs/, data/).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(mail): plaintext loopback IMAP so the gateway bypasses Mailu's front

Mailu's front (nginx mail proxy) pre-authenticates against Mailu's user DB before
proxying to Dovecot, which rejects the Dovecot master-user login <addr>*gateway.
The gateway must reach Dovecot directly. The imap container has no TLS cert (only
the front does), so the bypass is plaintext over loopback — the master password
never leaves the host.

- mailbox: IMAPConfig.Plaintext dials with DialInsecure (loopback only).
- main.go: mailClientFor sets Plaintext from AGENTBBS_MAIL_IMAP_PLAINTEXT.
- override.example: add the unbound resolver (admin needs DNSSEC), webmail image
  fix (2024.06 uses mailu/webmail), and publish Dovecot 143 on 127.0.0.1:14143.
- docs/mail.md: document the front-bypass, the dovecot.conf master passdb (Mailu
  includes that exact filename), and the 644 master-users perms (640 = temp_fail).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* deploy(mailu): wire gateway IMAP to the loopback Dovecot path in setup.sh

setup.sh §9e set AGENTBBS_MAIL_IMAP_ADDR to the front's :993, which the front's
auth proxy rejects for the master-user login (and would clobber the working
loopback wiring on every self-update). Point it at 127.0.0.1:14143 +
AGENTBBS_MAIL_IMAP_PLAINTEXT=1 instead, matching the override + docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* feat(mail): give free members a webmail password at join@

The gateway opens mailboxes via the Dovecot master user (no member password),
but webmail (Roundcube) needs the member to have a password. join@ now sets a
fresh, readable webmail password via the Mailu API and shows it with the webmail
URL + login, so free members can use webmail at mail.profullstack.com.

- mailu: SetPassword (PATCH /user/<email> raw_password) + test.
- main.go: setWebmailPassword + readablePassword; join@ displays url/login/password.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -368,10 +368,11 @@ AGENTBBS_HTTP_ADDR=${HTTP_ADDR}
 # AGENTBBS_SIGNUP_NOTIFY=anthony@profullstack.com
 
 # Membership model:
-#   Free   verified members get their own Docker pod (ssh pod@) and a homepage
-#          at https://${DOMAIN}/~<name>.
-#   Premium \$10 one-time, lifetime — a personal <name>@${DOMAIN} email
-#          (forwardemail.net) plus custom domains (ssh domain@). Offered at join@.
+#   Free   verified members get their own Docker pod (ssh pod@), a homepage at
+#          https://${DOMAIN}/~<name>, AND a real mailbox <name>@${DOMAIN} on the
+#          self-hosted Mailu stack (read it in the hub's "Mail" or via webmail).
+#   Premium \$10 one-time, lifetime — custom domains (ssh domain@) + a Tor shell.
+#          Offered at join@.
 
 # Premium payments hit the CoinPay REST API directly (no coinpay CLI needed):
 # join@ creates a charge and shows the amount + deposit address; a later connect
@@ -385,11 +386,23 @@ AGENTBBS_HTTP_ADDR=${HTTP_ADDR}
 # AGENTBBS_PREMIUM_CURRENCY=USD
 # AGENTBBS_PREMIUM_BLOCKCHAIN=eth
 
-# Premium email aliases (<name>@${DOMAIN}) auto-created on forwardemail.net.
-# Without an API key the address is shown but not created (add it manually).
-# AGENTBBS_FORWARDEMAIL_API_KEY=
-# AGENTBBS_FORWARDEMAIL_DOMAIN=${DOMAIN}
-# AGENTBBS_WEBMAIL_URL=https://webmail.${DOMAIN}
+# Member email (free for every verified member). Addresses are <name>@${DOMAIN}
+# (the address domain), while the Mailu server lives on the mail host below.
+# Mailboxes are auto-provisioned at join@ via the Mailu admin REST API: set the
+# API token (API_TOKEN in deploy/mailu/mailu.env). Without it the address is
+# shown but not created. See docs/mail.md.
+# AGENTBBS_MAIL_ADDR_DOMAIN=${DOMAIN}              # the @-part of member addresses
+# AGENTBBS_MAIL_ADMIN_URL=http://127.0.0.1:8080   # Mailu admin (loopback)
+# AGENTBBS_MAIL_API_TOKEN=<mailu API_TOKEN>
+# AGENTBBS_MAIL_QUOTA_BYTES=1073741824            # 1 GiB per mailbox
+# AGENTBBS_WEBMAIL_URL=https://${MAIL_DOMAIN}      # Roundcube (defaults to mail host)
+# The in-BBS mail reader opens mailboxes via a Dovecot master user, reaching
+# Dovecot directly over loopback (plaintext, on-host) to bypass Mailu's front
+# auth proxy. §9e sets these; the master pass is a secret (see docs/mail.md):
+# AGENTBBS_MAIL_IMAP_ADDR=127.0.0.1:14143
+# AGENTBBS_MAIL_IMAP_PLAINTEXT=1
+# AGENTBBS_MAIL_MASTER_USER=gateway
+# AGENTBBS_MAIL_MASTER_PASS=<gateway master password>
 
 # AgentGit (git.profullstack.com): every verified member — free and paid alike —
 # is provisioned a Forgejo account when they confirm their email. The admin token
@@ -1059,18 +1072,25 @@ else
   systemctl disable --now forgejo >/dev/null 2>&1 || true
 fi
 
-# ---- 9e. Mailu mail stack (co-located mail.${DOMAIN#*.}) --------------------
+# ---- 9e. Mailu mail stack (server on ${MAIL_DOMAIN}) ------------------------
 # Self-hosted Postfix+Dovecot+Roundcube+rspamd via Docker Compose. Mailu owns
 # the mail ports; Caddy fronts the loopback webmail and supplies the TLS cert
-# (TLS_FLAVOR=mail). agentbbs reads/sends on behalf of paid members. Full setup,
-# DNS, and the gateway master user: docs/mail.md. Disable with MAIL=0.
+# (TLS_FLAVOR=mail). agentbbs reads/sends on behalf of EVERY verified member
+# (free + paid) — addresses are <name>@${DOMAIN}, the server is ${MAIL_DOMAIN}.
+# Full setup, DNS, and the gateway master user: docs/mail.md. Disable with MAIL=0.
 MAILU_DIR="${SRC_DIR}/deploy/mailu"
 if [ "$MAIL" = "1" ]; then
-  log "configuring Mailu mail stack (${MAIL_DOMAIN})"
-  # Tell agentbbs how to reach the mailbox backend (master user/pass are secrets
-  # the operator sets; see docs/mail.md).
+  log "configuring Mailu mail stack (server ${MAIL_DOMAIN}, addresses @${DOMAIN})"
+  # Tell agentbbs how to reach the mailbox backend (master user/pass + the Mailu
+  # API token are secrets the operator sets; see docs/mail.md).
   upsert_env AGENTBBS_MAIL_DOMAIN "${MAIL_DOMAIN}"
-  upsert_env AGENTBBS_MAIL_IMAP_ADDR "${MAIL_DOMAIN}:993"
+  upsert_env AGENTBBS_MAIL_ADDR_DOMAIN "${DOMAIN}"
+  # The gateway reads Dovecot DIRECTLY over loopback (docker-compose.override.yml
+  # publishes it on 127.0.0.1:14143), bypassing Mailu's front nginx auth proxy so
+  # the master-user login works. Plaintext is safe — it never leaves the host.
+  # See docs/mail.md ("Why the gateway talks to Dovecot directly").
+  upsert_env AGENTBBS_MAIL_IMAP_ADDR "127.0.0.1:14143"
+  upsert_env AGENTBBS_MAIL_IMAP_PLAINTEXT "1"
   upsert_env AGENTBBS_MAIL_SMTP_ADDR "127.0.0.1:25"
 
   # Cert refresher: copy Caddy's mail cert into Mailu on renewal (like news/IRC).