feat(PROJ-71): TLS-Pflicht (optional) für eingehenden SMTP-BCC-Kanal

fix: Audit-Log-Detailspalte per Tooltip statt hartem Truncate lesbar machen

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/smtpd/smtpd.go

@@ -225,6 +225,8 @@ func (d *Daemon) Start() error {
 			return fmt.Errorf("smtpd: load TLS cert: %w", err)
 		}
 		srv.TLSConfig = &tls.Config{Certificates: []tls.Certificate{cert}}
+	} else if d.cfg.RequireTLS {
+		return fmt.Errorf("smtpd: require_tls is set but tls_cert/tls_key are missing")
 	}
 
 	d.mu.Lock()
@@ -322,16 +324,20 @@ func (b *backend) NewSession(c *smtp.Conn) (smtp.Session, error) {
 		}
 	}
 
-	b.daemon.logger.Debug("SMTP: new session", "ip", remoteIP)
+	_, isTLS := c.TLSConnectionState()
+
+	b.daemon.logger.Debug("SMTP: new session", "ip", remoteIP, "tls", isTLS)
 	return &session{
 		daemon:   b.daemon,
 		remoteIP: remoteIP,
+		isTLS:    isTLS,
 	}, nil
 }
 
 type session struct {
 	daemon   *Daemon
 	remoteIP string
+	isTLS    bool
 	from     string
 	rcpts    []string
 }
@@ -342,6 +348,14 @@ func (s *session) AuthPlain(_, _ string) error {
 }
 
 func (s *session) Mail(from string, _ *smtp.MailOptions) error {
+	if s.daemon.cfg.RequireTLS && !s.isTLS {
+		s.daemon.stats.Rejected.Add(1)
+		return &smtp.SMTPError{
+			Code:         530,
+			EnhancedCode: smtp.EnhancedCode{5, 7, 0},
+			Message:      "Must issue STARTTLS first",
+		}
+	}
 	s.from = from
 	return nil
 }