Configure private mail accounts with verified recipient restrictions #5295

🤖 Generated by the Agentic Engineer

Part of #5030. Preparation landed in #5289; the existing custom-domain mailbox will be migrated only after its destination and rollback are verified.

Prepare a default-off, repeatable configuration path for the pinned mail server. Generate accounts and recipient restrictions from private mounted inputs, apply them through the maintained native CLI, and verify enforcement with the real server before any public listener or MX change. Personal mail history must be preserved; digest retention is separate.

Acceptance criteria:

• Private mailbox/domain inputs and generated passwords come from mounted files, never committed plans, command arguments or logs; malformed or ambiguous inputs fail closed.
• Repeated native configuration preserves account identities and mail. Interrupted or failed configuration cannot promote the service to public activation.
• The agent account can read its inbox and send only to the configured maintainer recipient. It cannot submit elsewhere, import forged mail, mutate messages or use an upload bypass.
• MX does not offer AUTH; submission requires TLS and authentication before accepting an envelope, with sender matching enforced.
• The real pinned server proves allowed delivery, denied recipients including local ones, unauthenticated relay refusal, denied write/upload paths, restart persistence and configuration-error negative controls.
• The deployment remains disabled by default; the runbook preserves personal history and keeps DNS cutover, normal mail-app setup and production restore proof in Company Email infrastructure and service notifications #5030.

Priority: High. Effort: Medium. This establishes mailbox policy before the domain migration. No real mailbox address or credential belongs in this public tracker.