Antispam: the app could never authenticate to the learning engine

Rspamd answers on two ports and only one of them asks for a password:
the scan worker takes /checkv2 anonymously, the controller demands
`Password:` for /stat and /learnspam. `webmail.sh init` generates
RSPAMD_CONTROLLER_PASSWORD and docker-compose hands it to the rspamd
container — but the shared x-backend-env block that feeds api and
worker-* never carried it. The plugin reads it from the environment,
found "", and sent no header.

So classification worked and learning never did. Every learn returned
401 and the plugin swallowed it, as it is built to: an engine problem
must not lose mail. Bootstrap logged "engine unavailable", passive
learning from Inbox->Spam moves taught nothing, and the single visible
trace was `"bayes": null` on GET /api/plugins/antispam/stats, on an
install whose verdict counts were ticking up normally.

Verified against a live engine: with no password /stat and /learnspam
both 401 and rspamd.learn() returns False; with it, stats returns and
learn returns True.

  - pass RSPAMD_CONTROLLER_PASSWORD to the app containers, in both the
    production and dev compose files
  - doctor now makes the real call from inside the api container, with
    the password that container actually holds, and says plainly that
    nothing will be learned if it fails
  - a test reads both compose files, because this is a missing line that
    review already let through once

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

docker-compose.yml

@@ -63,6 +63,12 @@ x-backend-env: &backend-env
   SEARCH_BACKEND: ${SEARCH_BACKEND:-pg}
   MEILI_URL: ${MEILI_URL:-http://meilisearch:7700}
   MEILI_KEY: ${MEILI_MASTER_KEY:-}
+  # The antispam engine splits across two ports: the scan worker (:11333) takes
+  # anonymous /checkv2, the controller (:11334) demands this password for /stat
+  # and /learnspam. Without it here, classification works and LEARNING SILENTLY
+  # DOES NOT — the controller answers 401, the plugin fails open, and the only
+  # visible symptom is "bayes": null on the stats endpoint.
+  RSPAMD_CONTROLLER_PASSWORD: ${RSPAMD_CONTROLLER_PASSWORD}
   LOG_LEVEL: ${LOG_LEVEL:-INFO}
   UNDO_SECONDS: ${UNDO_SECONDS:-10}
   SESSION_TTL_DAYS: ${SESSION_TTL_DAYS:-30}