feat(PROJ-21): Phase 2+3+5+8 Multi-Tenancy + PROJ-2 EML/MBOX Upload

Phase 2a: userstore domain_admin/superadmin Rollen, User.TenantID,
          ListByTenant, UpsertLDAPUser mit tenantID
Phase 2b: storage.Save() mit tenantID *int64, email_refs Tabelle,
          GetTenantForMail, GetAllIDsByTenant, StatsByTenant
Phase 2c: JWT-Claims tenant_id/tenant_slug, Session.TenantID,
          Login Domain-Erkennung via E-Mail-Domain
Phase 3:  tenantMiddleware, Handler-Filterung (Users, Mail, Stats)
Phase 5:  SMTP Domain-Routing via DomainToTenantFunc Callback,
          config smtp.tenant_routing + default_tenant_id
Phase 8:  archivmail migrate-tenants Subkommando
PROJ-2:   Upload-Seite /admin/upload mit DropZone + Progress-Polling

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

config/config.go

@@ -57,13 +57,15 @@ func (d DatabaseConfig) DSN() string {
 
 // SMTPConfig holds settings for the embedded SMTP server.
 type SMTPConfig struct {
-	Enabled    bool     `yaml:"enabled"`
-	Bind       string   `yaml:"bind"`
-	Domain     string   `yaml:"domain"`
-	TLSCert    string   `yaml:"tls_cert"`
-	TLSKey     string   `yaml:"tls_key"`
-	MaxSizeMB  int      `yaml:"max_size_mb"`
-	AllowedIPs []string `yaml:"allowed_ips"`
+	Enabled         bool     `yaml:"enabled"`
+	Bind            string   `yaml:"bind"`
+	Domain          string   `yaml:"domain"`
+	TLSCert         string   `yaml:"tls_cert"`
+	TLSKey          string   `yaml:"tls_key"`
+	MaxSizeMB       int      `yaml:"max_size_mb"`
+	AllowedIPs      []string `yaml:"allowed_ips"`
+	TenantRouting   string   `yaml:"tenant_routing"`    // "domain" or "default"
+	DefaultTenantID int64    `yaml:"default_tenant_id"` // used when routing is "default" or domain lookup fails
 }
 
 // IndexConfig holds full-text index settings.