Antispam: online checks no longer switch off Bayes; replies teach ham

- The "online reputation checks" rspamd profile used groups_enabled,
  which means ONLY those groups: with the switch on, a message got the
  RBL lookups alone (1 rule instead of 19, score 0.00) and Bayes never
  ran, so every spam lesson was ignored. It now disables nothing.
- A reply or reply-all teaches the answered message as ham (not
  forwards or new mail, not one's own Sent/Drafts, never over an
  explicit spam mark; once per message). message.sent now carries the
  draft's kind and reply_to_message_id.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/rspamd/local.d/settings.conf

@@ -23,11 +23,16 @@ webmail_offline {
   }
 }
 
-# Opted in: Spamhaus ZEN + DBL and DNSWL, as narrowed in rbl.conf.
+# Opted in: Spamhaus ZEN + DBL and DNSWL, as narrowed in rbl.conf — on top of
+# everything else. Nothing to switch on (those modules are enabled globally;
+# only the offline profile turns them off), so this profile changes nothing.
+# NOT `groups_enabled`: that means "ONLY these groups", and it left a user who
+# allowed online checks with the reputation lookups alone — no Bayes, no content
+# rules, every lesson they taught ignored.
 webmail_network {
   id = "webmail_network";
   priority = high;
   apply {
-    groups_enabled = ["rbl", "surbl"];
+    groups_disabled = [];
   }
 }