Add encryption policy, split delivery and SecureMailSender

- delivery: PolicyResolver (address > *@domain > default), RecipientKeyResolver
  (discovery + validation), DeliveryPlanner (REQUIRE refusal, SPLIT/FAIL,
  own copy per Bcc with hidden key IDs), MessageAssembler with sender keys
  for readable sent copies, EnvelopeMimeMessage for per-copy SMTP envelopes
- sender: SecureMailSender with BUILT_IN and RELAY implementations and a
  per-recipient SendReport; relay passes the strictest policy as a header hint
- autoconfigure: mode, default-policy, mixed-mode, recipients, sender-keys
  and relay properties; relay sender is not a bean so spring.mail stays intact
- demo: sends through SecureMailSender

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G71TQ5jDETVwdUJxGAwaiT

mailsender-demo/src/main/resources/application.yml

@@ -13,6 +13,23 @@ spring:
       mail.smtp.connectiontimeout: 10000
       mail.smtp.timeout: 10000
 
+mail:
+  pgp:
+    mode: ${MAIL_PGP_MODE:BUILT_IN}            # BUILT_IN | RELAY
+    default-policy: ${MAIL_PGP_DEFAULT_POLICY:OPPORTUNISTIC}
+    mixed-mode: SPLIT
+    # recipients:
+    #   "[*@partner.example]": REQUIRE
+    # Readable sent copies: the sender's own PUBLIC key per From address.
+    # sender-keys:
+    #   "[noreply@example.com]": file:/etc/mail/noreply.pub.asc
+    relay:
+      host: ${RELAY_HOST:}
+      port: ${RELAY_PORT:587}
+      username: ${RELAY_USERNAME:}
+      password: ${RELAY_PASSWORD:}
+      policy-header: X-Encryption-Policy
+
 demo:
   to: ${DEMO_TO:test@thinhha.pro}
   from: ${DEMO_FROM:${SMTP_USERNAME:}}