Rewrite as a Rust, Apache-2.0 workspace

Supersedes the Go + embed-Mox design. The Go tree is removed; its
architecture doc is preserved at docs/archive/ARCHITECTURE-go-embed-mox.md
because its competitive analysis and data model still hold.

Five decisions recorded as ADRs:

  0001  Rust, not Go — accepting ~5,500 lines of protocol code that Mox
        would have given us free, to get the first permissively licensed
        Rust mail server. Costs stated plainly.
  0002  Apache-2.0, not MIT or AGPL — patent grant, trademark, CLA-free
        contribution. Public on GitHub; Gitea stays as the private fallback.
  0003  Stalwart's primitive crates (Apache-2.0/MIT) yes; its AGPL server
        crates never. DANE and MTA-STS sit on the AGPL side of that line,
        which is why we write our own.
  0004  Milestones, reordered: embedded inbound is required at launch.
  0005  Oracle Cloud blocks outbound :25, so direct-to-MX is impossible on
        the launch host. Split delivery is mandatory, not an on-ramp.

Twelve crates in three tiers. Tier 1 (mail-dane, mail-mta-sts, mail-dsn)
is standalone and publishable — no `dane` or `mta-sts` crate exists on
crates.io at all today.

openmail-relay ships the provider table as data, with SES and Oracle from
the start. Oracle's and Resend's SPF includes are deliberately None: a
guessed include turns the DNS check green against a mechanism the provider
does not honour, and mail still fails SPF silently.

cargo check/test/clippy/fmt all green; unsafe_code is forbidden workspace
wide; cargo-deny enforces the licence policy in CI.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7

crates/openmail-smtpd/Cargo.toml

@@ -0,0 +1,23 @@
+[package]
+name = "openmail-smtpd"
+description = "Inbound SMTP server: session state machine, STARTTLS, AUTH, pipelining."
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+homepage.workspace = true
+authors.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+smtp-proto.workspace = true
+mail-parser.workspace = true
+mail-auth.workspace = true
+openmail-guard.workspace = true
+tokio.workspace = true
+rustls.workspace = true
+thiserror.workspace = true
+tracing.workspace = true

crates/openmail-smtpd/src/lib.rs

@@ -0,0 +1,42 @@
+//! Inbound SMTP server.
+//!
+//! `smtp-proto` parses the wire format; everything above it — session state,
+//! STARTTLS, AUTH, PIPELINING, SIZE, and the abuse gate — is here. This is the
+//! largest single piece of protocol work in the workspace and the one exposed
+//! directly to the open internet, so: no `unsafe`, hard limits on every
+//! unbounded input, and a timeout on every state.
+//!
+//! Note that on hosts which block outbound :25 (Oracle Cloud), this listener
+//! still works — the block is outbound only. See `docs/adr/0005-oracle-cloud.md`.
+
+/// Hard limits. Every one of these exists because its absence is a `DoS`.
+#[derive(Debug, Clone, Copy)]
+pub struct Limits {
+    pub max_message_bytes: usize,
+    pub max_recipients: usize,
+    pub max_commands_per_session: usize,
+    pub command_timeout_secs: u64,
+    pub data_timeout_secs: u64,
+}
+
+impl Default for Limits {
+    fn default() -> Self {
+        Self {
+            max_message_bytes: 50 * 1024 * 1024,
+            max_recipients: 100,
+            max_commands_per_session: 500,
+            command_timeout_secs: 300,
+            data_timeout_secs: 600,
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("io: {0}")]
+    Io(#[from] std::io::Error),
+    #[error("protocol: {0}")]
+    Protocol(String),
+    #[error("limit exceeded: {0}")]
+    Limit(String),
+}