tls: surface transport TLS status in email path and authentication

Parse TLS details (version, cipher, bits, cert verification) from the
Postfix Received header parenthetical and expose them per hop, rendered
as a per-hop badge in the Email Path card.

Add an x-tls Authentication-Results result: parse it when present, and
otherwise synthesize it from the inbound hop's TLS info. A negative
result (unencrypted inbound connection) applies a -10 authentication
score penalty and is shown in the Authentication card. Enable the TLS
handler in authentication_milter.

Closes: #40

docker/postfix/main.cf

@@ -36,5 +36,8 @@ smtpd_recipient_restrictions =
     permit_mynetworks,
     reject_unauth_destination
 
+# TLS - record the negotiated cipher/protocol in the Received: header
+smtpd_tls_received_header = yes
+
 # Logging
 debug_peer_level = 2