Antispam: the app could never authenticate to the learning engine

Rspamd answers on two ports and only one of them asks for a password:
the scan worker takes /checkv2 anonymously, the controller demands
`Password:` for /stat and /learnspam. `webmail.sh init` generates
RSPAMD_CONTROLLER_PASSWORD and docker-compose hands it to the rspamd
container — but the shared x-backend-env block that feeds api and
worker-* never carried it. The plugin reads it from the environment,
found "", and sent no header.

So classification worked and learning never did. Every learn returned
401 and the plugin swallowed it, as it is built to: an engine problem
must not lose mail. Bootstrap logged "engine unavailable", passive
learning from Inbox->Spam moves taught nothing, and the single visible
trace was `"bayes": null` on GET /api/plugins/antispam/stats, on an
install whose verdict counts were ticking up normally.

Verified against a live engine: with no password /stat and /learnspam
both 401 and rspamd.learn() returns False; with it, stats returns and
learn returns True.

  - pass RSPAMD_CONTROLLER_PASSWORD to the app containers, in both the
    production and dev compose files
  - doctor now makes the real call from inside the api container, with
    the password that container actually holds, and says plainly that
    nothing will be learned if it fails
  - a test reads both compose files, because this is a missing line that
    review already let through once

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

backend/tests/plugins/test_antispam_learning.py

@@ -328,3 +328,34 @@ async def test_one_failing_account_does_not_stop_the_sweep(
     monkeypatch.setattr(jobs, "bootstrap_account", _one)
     await jobs.bootstrap_sweep({})
     assert done == [str(accounts[0][1]), str(accounts[2][1])]
+
+
+def test_compose_gives_the_app_the_controller_password() -> None:
+    """The learning loop needs the controller password; classification does not.
+
+    Rspamd splits over two ports: the scan worker takes /checkv2 anonymously,
+    the controller demands a password for /stat and /learnspam. Ship the password
+    to rspamd but not to the api/worker containers and the result is a filter
+    that looks healthy — mail is still classified — while every learn is refused
+    401 and swallowed by the plugin's fail-open path. The only visible trace is
+    `"bayes": null` on the stats endpoint.
+
+    That shipped, so it is worth a test that reads the compose files rather than
+    trusting review to catch the missing line again.
+    """
+    import pathlib
+
+    root = pathlib.Path(__file__).resolve().parents[3]
+    for rel, anchor in (
+        ("docker-compose.yml", "x-backend-env:"),
+        ("docker/docker-compose.yml", "environment: &worker-env"),
+    ):
+        text = (root / rel).read_text()
+        assert anchor in text, f"{rel}: shared env block moved; update this test"
+        start = text.index(anchor)
+        # The shared block runs to the next top-level key.
+        block = text[start : text.index("\nservices:", start) if "\nservices:" in text[start:] else len(text)]
+        assert "RSPAMD_CONTROLLER_PASSWORD" in block, (
+            f"{rel}: the app containers do not receive RSPAMD_CONTROLLER_PASSWORD — "
+            "antispam will classify but never learn"
+        )