mailserver: overhaul inbound delivery, monitoring, CrowdSec, and migrate to Brevo relay

Inbound:
- Direct MX to mail.viktorbarzin.me (ForwardEmail relay attempted and abandoned)
- Dedicated MetalLB IP 10.0.20.202 with ETP: Local for CrowdSec real-IP detection
- Removed Cloudflare Email Routing (can't store-and-forward)
- Fixed dual SPF violation, hardened to -all
- Added MTA-STS, TLSRPT, imported Rspamd DKIM into Terraform
- Removed dead BIND zones from config.tfvars (199 lines)

Outbound:
- Migrated from Mailgun (100/day) to Brevo (300/day free)
- Added Brevo DKIM CNAMEs and verification TXT

Monitoring:
- Probe frequency: 30m → 20m, alert thresholds adjusted to 60m
- Enabled Dovecot exporter scraping (port 9166)
- Added external SMTP monitor on public IP

Documentation:
- New docs/architecture/mailserver.md with full architecture
- New docs/architecture/mailserver-visual.html visualization
- Updated monitoring.md, CLAUDE.md, historical plan docs

stacks/mailserver/modules/mailserver/main.tf

@@ -68,7 +68,7 @@ resource "kubernetes_config_map" "mailserver_env_config" {
     POSTFIX_REJECT_UNKNOWN_CLIENT_HOSTNAME = "1"
     # TLS_LEVEL                              = "intermediate"
     # DEFAULT_RELAY_HOST = "[smtp.sendgrid.net]:587"
-    DEFAULT_RELAY_HOST = "[smtp.eu.mailgun.org]:587"
+    DEFAULT_RELAY_HOST = "[smtp-relay.brevo.com]:587"
     SPOOF_PROTECTION   = "1"
     SSL_TYPE           = "manual"
     SSL_CERT_PATH      = "/tmp/ssl/tls.crt"
@@ -487,14 +487,13 @@ resource "kubernetes_service" "mailserver" {
     }
 
     annotations = {
-      "metallb.io/loadBalancerIPs" = "10.0.20.200"
-      "metallb.io/allow-shared-ip" = "shared"
+      "metallb.io/loadBalancerIPs" = "10.0.20.202"
     }
   }
 
   spec {
     type                    = "LoadBalancer"
-    external_traffic_policy = "Cluster"
+    external_traffic_policy = "Local"
     selector = {
       app = "mailserver"
     }
@@ -549,7 +548,7 @@ resource "kubernetes_cron_job_v1" "email_roundtrip_monitor" {
     concurrency_policy            = "Replace"
     failed_jobs_history_limit     = 3
     successful_jobs_history_limit = 3
-    schedule                      = "*/10 * * * *"
+    schedule                      = "*/20 * * * *"
     job_template {
       metadata {}
       spec {

stacks/mailserver/modules/mailserver/variables.tf

@@ -3,7 +3,7 @@
 variable "postfix_cf" {
   default = <<EOT
 #relayhost = [smtp.sendgrid.net]:587
-relayhost = [smtp.eu.mailgun.org]:587
+relayhost = [smtp-relay.brevo.com]:587
 smtp_sasl_auth_enable = yes
 smtp_sasl_password_maps = hash:/etc/postfix/sasl/passwd
 smtp_sasl_security_options = noanonymous