Deploy: set_env_value could not add a key, and said it had

`sed "s|^KEY=.*|KEY=value|"` only rewrites a line that already exists. A setting
introduced by a later release is absent from an older .env, so the substitution
matched nothing, reported success, and the value vanished — while
`ensure_secrets` printed "RSPAMD_CONTROLLER_PASSWORD was empty — generated one".

The v1.1.0 upgrade then ran with a blank controller password: every compose call
warned, the engine came up unauthenticated, and learning would have failed
against it. Classification was unaffected, which is exactly what made it quiet.

Now appends when the key is absent — ensuring the file ends in a newline first,
so the key cannot be glued onto the last line of a hand-edited .env — and
verifies the value is present afterwards rather than trusting sed's exit status.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

deploy/webmail.sh

@@ -129,8 +129,24 @@ state_dir() { echo "${DATA_ROOT}/state"; }
 # in-place edit goes through a temp file.
 set_env_value() {
     local key="$1" value="$2"
+    if grep -q "^${key}=" "$ENV_FILE" 2>/dev/null; then
         sed "s|^${key}=.*|${key}=${value}|" "$ENV_FILE" > "${ENV_FILE}.tmp" \
-        && mv "${ENV_FILE}.tmp" "$ENV_FILE" && chmod 600 "$ENV_FILE"
+            && mv "${ENV_FILE}.tmp" "$ENV_FILE"
+    else
+        # A key introduced by a later release is simply absent from an older
+        # .env, and `sed s|^KEY=.*|` substitutes nothing while reporting success
+        # — so a generated secret was announced and then silently dropped. Append
+        # instead, after making sure the file ends in a newline so the new key
+        # cannot be glued onto the last line.
+        if [ -s "$ENV_FILE" ] && [ -n "$(tail -c1 "$ENV_FILE")" ]; then
+            printf '\n' >> "$ENV_FILE"
+        fi
+        printf '%s=%s\n' "$key" "$value" >> "$ENV_FILE"
+    fi
+    chmod 600 "$ENV_FILE"
+    # Never report success for a value that did not land: this function silently
+    # dropped a generated secret once, and the install only failed much later.
+    grep -q "^${key}=" "$ENV_FILE" || die "failed to write ${key} to ${ENV_FILE}"
 }
 
 record_version() {