#19: repair the compose stack and wire Rspamd to Redis

"docker compose up" could not work, which means the F0 acceptance
criterion was not being met:

  - ghcr.io/rspamd/rspamd:3.9 returns "denied" and clamav/clamav:1.3 does
    not exist. Both were verified against the registries; the working
    references are rspamd/rspamd:3.9 and clamav/clamav:1.4.

  - Rspamd received RSPAMD_REDIS_SERVERS and RSPAMD_REDIS_PASSWORD as
    environment variables it never reads. Confirmed in the container that
    it does not expand ${VAR} in UCL: the password reached Redis as that
    literal string. Greylisting and ratelimit keep their state in Redis,
    so both were silently doing nothing while appearing configured. The
    credential is now rendered at startup into override.d, a tmpfs, so it
    touches neither the image nor a volume.

  - The ratelimit module ships enabled with no rates defined, which
    accepts everything. ratelimit.conf defines the per-IP, per-user and
    per-recipient buckets of section 5.2.

Verified by bringing redis and rspamd up: the real password resolves, the
rates load, and a probe message returns "Action: greylist" with the state
written to Redis.

Services also gained an image: alongside build:, so the deploy host pulls
instead of compiling while "docker compose build" still works locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.env.example

@@ -1,3 +1,12 @@
+# --- Container images ---
+# Published to GHCR by .github/workflows/release.yml, multi-architecture
+# (linux/amd64 and linux/arm64). The deploy host pulls these instead of
+# compiling: `docker compose pull && docker compose up -d`. Running
+# `docker compose build` locally still overrides them with a local build.
+# Pin IMAGE_TAG to a released version (e.g. 1.2.3) or a sha- tag to roll back.
+IMAGE_NAMESPACE=ghcr.io/lucasrguerra/lambdamail
+IMAGE_TAG=latest
+
 # --- Postgres ---
 POSTGRES_DB=lambdamail
 POSTGRES_USER=lambdamail