#21: ship the migrations and the Rspamd config inside images

The deployment failed on the migrate service. Coolify rewrites a relative
bind mount to a path under its own application directory, and when that
resolves to an empty directory golang-migrate finds no migrations and
exits 1 - with nothing useful in the deployment log to say why.

A deployment that pulls its images has no business also depending on
files being at a particular path on the host. Both mounts are now baked
into images built from the repository root:

  migrations - the schema, so migrate always has it
  rspamd     - actions.conf and ratelimit.conf

The Rspamd one mattered for a quieter reason: Rspamd starts happily with
an empty local.d, so a mount that resolved to nothing would have left the
rate limits and score thresholds unapplied. The defence would have looked
configured and done nothing.

Both images join the CI and release matrices, building from the root
context. Verified by building them, checking their contents, and bringing
the whole stack up - Rspamd reports its nine rate directives loaded from
the image.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -163,7 +163,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        service: [protocols, auth, storage, webmail]
+        service: [protocols, auth, storage, webmail, migrations, rspamd]
     steps:
       - uses: actions/checkout@v7
 
@@ -174,7 +174,8 @@ jobs:
       - name: Build
         uses: docker/build-push-action@v7
         with:
-          context: services/${{ matrix.service }}
+          context: ${{ (matrix.service == 'migrations' || matrix.service == 'rspamd') && '.' || format('services/{0}', matrix.service) }}
+          file: services/${{ matrix.service }}/Dockerfile
           push: false
           load: true
           tags: lambdamail-${{ matrix.service }}:ci