feat(dkim): add outbound DKIM signing

[EvalAlan]

Summary

Adds outbound DKIM signing. Previously the plugin system only verified DKIM/DMARC/ARC on inbound mail; there was no signing path, which hurts deliverability to Gmail/Yahoo/Outlook. This signs outbound mail on the remote SMTP delivery path.

Design decisions

• Library reuse, no new signing scheme. The signer wraps github.com/emersion/go-msgauth/dkim, the same library referenced by the existing verification code. It supports both signing and verifying with RSA and Ed25519, so the unit tests verify exactly what we sign. No hand-rolled DKIM crypto was added.
• Integration point: SMTPDeliveryHandler (remote delivery), not LMTP. Signing is applied in DeliverMessageWithMetadata once, before recipients are grouped by domain, so identical signed bytes go to every MX. Local LMTP delivery (to Dovecot) is intentionally not signed — a locally delivered copy never crosses an administrative boundary where DKIM matters. The signer is attached via SetDKIMSigner, wired up in initQueueSystem.
• No double-signing on retry. Signer.Sign is idempotent: if the content already carries a DKIM-Signature for the selected domain (folded continuation lines handled), it returns the content unchanged. A delivery retry therefore never adds a second signature. This is covered by tests at both the signer and delivery-handler level.
• Signing-domain selection. The domain is taken from the envelope-from address, falling back to the From header domain when the envelope-from is empty (e.g. bounces/DSNs with a null return path). If no key is configured for the resolved domain, the message is delivered unsigned with a debug log — never failed.
• Fail-open on signing errors. A signing error logs a warning and delivers the unsigned message rather than failing it outright.
• Security posture. Private keys are permission-checked on load; any key readable/writable by group or other (0077 bits) is rejected, matching the repo's existing file-security checks. Keys are validated up-front in NewSigner so a misconfiguration fails fast at start-up.
• Config. New top-level [dkim] section: enabled, header_canonicalization/body_canonicalization (default relaxed/relaxed), and per-domain [[dkim.domains]] blocks with domain, selector, private_key_path, and optional headers_to_sign (defaults to From, To, Cc, Subject, Date, Message-ID, MIME-Version, Content-Type, Reply-To, In-Reply-To, References).

Files changed

• internal/dkim/signer.go — new package: config types, key loading (PKCS#1/PKCS#8/SEC1, RSA + Ed25519), permission validation, signing, domain resolution helpers.
• internal/queue/delivery_handler.go — messageSigner seam, SetDKIMSigner, signContent, sign call in DeliverMessageWithMetadata.
• internal/config/config.go, internal/smtp/config.go — [dkim] config field.
• cmd/elemta/commands/server.go, internal/smtp/server.go — build the signer and attach it to the remote SMTP handler.
• Tests: internal/dkim/signer_test.go, internal/config/dkim_config_test.go, internal/queue/delivery_dkim_test.go.
• Docs: docs/dkim-signing.md, section in docs/configuration.md, [dkim] example in config/elemta.toml.example.

Testing

• go build ./..., go vet ./... — clean.
• gofmt -l . — empty.
• go test ./... — full suite passes.

Tests include RSA and Ed25519 sign→verify round-trips through the verification path, config parsing, insecure-key-permission rejection, and retry-does-not-double-sign at both layers.