Antispam: mirror the engine in dev, and never file a contact as spam

Dev compose gains rspamd + redis-rspamd, matching production. The dev API and
worker run on the host rather than in the compose network, so the ports are
published on loopback and RSPAMD_URL points at 127.0.0.1 — documented in
.env.example.

Contacts now cap a verdict at "banner": mail from someone in the user's address
book is never moved to Junk. Capped rather than exempted, because the way this
fails in practice is a contact's account being compromised and spamming its own
address book — the warning still has value even when the move would be wrong.
An explicit deny rule still wins; that is the user overruling us deliberately.

The lookup reads the contacts plugin's table directly and forgives its absence:
no contacts plugin means no contacts to check, not an error. Addresses are
stored as the user typed them, so both sides are lower-cased rather than relying
on the jsonb containment index, and secondary addresses in the emails array
count as well as the primary. It runs only when the verdict would otherwise be a
move, so the common path pays nothing.

Also fixes a test that asserted stats degrade "without an engine" by relying on
no engine being present — true until this commit. It now simulates the absence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018SqJYt7jD7oUEkoY68sBZo

docker/docker-compose.yml

@@ -66,6 +66,52 @@ services:
       postgres: { condition: service_healthy }
       redis: { condition: service_healthy }
 
+  # Anti-spam engine, mirroring the production stack (see ../docker-compose.yml).
+  # Dev publishes the ports on loopback so the plugin can be driven from the host
+  # (RSPAMD_URL=http://127.0.0.1:11333) as well as from a container.
+  rspamd:
+    image: rspamd/rspamd:3.9
+    # Root only long enough to write the controller password; rspamd then drops
+    # to _rspamd itself. /etc/rspamd is root-owned in the image.
+    user: root
+    entrypoint:
+      - /bin/sh
+      - -c
+      - |
+        mkdir -p /etc/rspamd/override.d
+        printf 'password = "%s";\nenable_password = "%s";\n' \
+          "$$RSPAMD_CONTROLLER_PASSWORD" "$$RSPAMD_CONTROLLER_PASSWORD" \
+          > /etc/rspamd/override.d/worker-controller.inc
+        exec /usr/bin/rspamd -f -u _rspamd -g _rspamd
+    environment:
+      RSPAMD_CONTROLLER_PASSWORD: ${RSPAMD_CONTROLLER_PASSWORD:-devpass}
+    volumes:
+      - ./rspamd/local.d:/etc/rspamd/local.d:ro
+      - rspamddata:/var/lib/rspamd
+    ports:
+      - "127.0.0.1:11333:11333"   # scan worker  (/checkv2)
+      - "127.0.0.1:11334:11334"   # controller   (/learnspam, /stat)
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:11334/ping | grep -qi pong"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+      start_period: 15s
+    depends_on:
+      redis-rspamd: { condition: service_healthy }
+
+  # Bayes/fuzzy storage, separate from the app redis on purpose (SPEC §C.2).
+  redis-rspamd:
+    image: redis:7-alpine
+    command: [redis-server, --save, "300", "1", --maxmemory, 128mb, --maxmemory-policy, allkeys-lru]
+    volumes:
+      - rspamdredis:/data
+    healthcheck:
+      test: ["CMD", "redis-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 10
+
   # Test mail servers (integration tests + manual dev against a throwaway mailbox)
   greenmail:
     image: greenmail/standalone:2.0.1
@@ -82,3 +128,5 @@ volumes:
   pgdata:
   meilidata:
   blobs:
+  rspamddata:
+  rspamdredis: