Add connect-time abuse protection to the MX and MSA ports #409

What happened

Scanners and broken clients hit ports 25 and 587 continuously. Nothing blocks them or even counts them. Three Sentry issues (672, 198, and 5 events since late August) are peer failures after STARTTLS, with 0 users impacted.

• No connection limits, no DNSBL, no AUTH attempt limit (SMTPHandler.handle_AUTH), and no recipient cap (MXHandler.handle_RCPT). command_call_limit is unset.
• No attribution. aiosmtpd logs session.peer, which behind Caddy is 10.244.0.1. The real client IP exists only in the PROXY v2 header (services/email/proxy_protocol.py). handle_PROXY runs before the banner, so the app can act on it.

Constraints, verified

• caddy-l4 on TCP has no idle timeout (idle_timeout applies to UDP only), no rate limiter, no SMTP matcher, and no pregreet test. Matchers see the first bytes only. remote_ip and close work.
• aiosmtpd timeout defaults to 300 s, resets per command, and does not reset during smtp_DATA, so the message body counts against it. 32 MiB needs about 110 kB/s at 300 s. RELAY_PROXY_PROTOCOL_TIMEOUT is unset.
• asyncio's 60 s SSL_HANDSHAKE_TIMEOUT is not configurable through the aiosmtpd STARTTLS path.
• postscreen fronts Postfix only. Greylisting delays mail. Spamhaus DQS is paid for commercial use. If proxy-level limits or timeouts are wanted later, CrowdSec, HAProxy, and nginx stream are the outs.

Plan

1. Measure. Log the real client IP at connect and count connections, STARTTLS failures, and AUTH failures per IP in Redis. The layer4 DEBUG logs give the same raw data without code.
2. Close what is not SMTP. Use @x http and @x tls plus close on 25 and 587. Real clients wait for the banner and speak plaintext first, so HTTP and implicit TLS probes never reach the app.
3. Terminate idle sessions in aiosmtpd. Pick timeout from the slowest sender that we are willing to serve, and set RELAY_PROXY_PROTOCOL_TIMEOUT.
4. Add a connect guard in handle_PROXY: per-IP caps and a deny set. Fail open on Redis errors. Log denials against the real client IP.
5. Add AUTH limits on 587.
6. Only if needed, add CrowdSec with the firewall bouncer, or nginx or HAProxy in front for proxy-level limits and timeouts.

Non-goals

Filtering the STARTTLS failures themselves, since the client fails after the 220 banner, and greylisting.