feat(PROJ-71): TLS-Pflicht (optional) für eingehenden SMTP-BCC-Kanal

fix: Audit-Log-Detailspalte per Tooltip statt hartem Truncate lesbar machen

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

config/config.go

@@ -184,6 +184,7 @@ type SMTPConfig struct {
 	Domain          string   `yaml:"domain"`
 	TLSCert         string   `yaml:"tls_cert"`
 	TLSKey          string   `yaml:"tls_key"`
+	RequireTLS      bool     `yaml:"require_tls"` // PROJ-71: reject DATA over plaintext when true (needs tls_cert/tls_key set)
 	MaxSizeMB       int      `yaml:"max_size_mb"`
 	AllowedIPs      []string `yaml:"allowed_ips"`
 	TenantRouting   string   `yaml:"tenant_routing"`    // "domain" or "default"