#19: repair the compose stack and wire Rspamd to Redis

"docker compose up" could not work, which means the F0 acceptance
criterion was not being met:

  - ghcr.io/rspamd/rspamd:3.9 returns "denied" and clamav/clamav:1.3 does
    not exist. Both were verified against the registries; the working
    references are rspamd/rspamd:3.9 and clamav/clamav:1.4.

  - Rspamd received RSPAMD_REDIS_SERVERS and RSPAMD_REDIS_PASSWORD as
    environment variables it never reads. Confirmed in the container that
    it does not expand ${VAR} in UCL: the password reached Redis as that
    literal string. Greylisting and ratelimit keep their state in Redis,
    so both were silently doing nothing while appearing configured. The
    credential is now rendered at startup into override.d, a tmpfs, so it
    touches neither the image nor a volume.

  - The ratelimit module ships enabled with no rates defined, which
    accepts everything. ratelimit.conf defines the per-IP, per-user and
    per-recipient buckets of section 5.2.

Verified by bringing redis and rspamd up: the real password resolves, the
rates load, and a probe message returns "Action: greylist" with the state
written to Redis.

Services also gained an image: alongside build:, so the deploy host pulls
instead of compiling while "docker compose build" still works locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yaml

@@ -71,15 +71,28 @@ services:
 
   # ------------------------------------------------------------ RSPAMD
   rspamd:
-    image: ghcr.io/rspamd/rspamd:3.9
+    image: rspamd/rspamd:3.9
     restart: *restart
     logging: *default-logging
     environment:
-      RSPAMD_REDIS_SERVERS: redis
-      RSPAMD_REDIS_PASSWORD: ${REDIS_PASSWORD}
+      REDIS_PASSWORD: ${REDIS_PASSWORD}
     volumes:
       - ./config/rspamd:/etc/rspamd/local.d:ro
       - rspamd_data:/var/lib/rspamd
+    # Rspamd does NOT expand environment variables in its UCL config - a
+    # "${REDIS_PASSWORD}" written into a .conf reaches Redis as that literal
+    # string. The credential is therefore rendered at startup into override.d,
+    # which is a tmpfs so the secret never touches the image or a volume.
+    # Without this, greylisting and ratelimit silently do nothing: both keep
+    # their state in Redis.
+    tmpfs:
+      - /etc/rspamd/override.d:uid=11333,gid=11333,mode=0700
+    entrypoint:
+      - sh
+      - -c
+      - >-
+        printf 'servers = "redis:6379";\npassword = "%s";\n' "$$REDIS_PASSWORD"
+        > /etc/rspamd/override.d/redis.conf && exec /usr/bin/rspamd -f
     depends_on:
       redis: { condition: service_healthy }
     healthcheck:
@@ -91,7 +104,7 @@ services:
 
   # ------------------------------------------------------------ CLAMAV
   clamav:
-    image: clamav/clamav:1.3
+    image: clamav/clamav:1.4
     restart: *restart
     logging: *default-logging
     volumes: [clamav_data:/var/lib/clamav]
@@ -105,6 +118,7 @@ services:
 
   # -------------------------------------------------------------- AUTH
   auth:
+    image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/auth:${IMAGE_TAG:-latest}
     build: { context: ./services/auth }
     restart: *restart
     logging: *default-logging
@@ -134,6 +148,7 @@ services:
 
   # ----------------------------------------------------------- STORAGE
   storage:
+    image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/storage:${IMAGE_TAG:-latest}
     build: { context: ./services/storage }
     restart: *restart
     logging: *default-logging
@@ -163,6 +178,7 @@ services:
 
   # --------------------------------------------------------- PROTOCOLS
   protocols:
+    image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/protocols:${IMAGE_TAG:-latest}
     build: { context: ./services/protocols }
     restart: *restart
     logging: *default-logging
@@ -238,6 +254,7 @@ services:
 
   # -------------------------------------------------------------- WEB
   web:
+    image: ${IMAGE_NAMESPACE:-ghcr.io/lucasrguerra/lambdamail}/webmail:${IMAGE_TAG:-latest}
     build: { context: ./services/webmail }
     restart: *restart
     logging: *default-logging