Add OpenPGP and S/MIME signing of outgoing mail

mail.pgp.signing.type selects NONE (default), OPENPGP or SMIME, with one
key/certificate per From address.

- OPENPGP: plaintext copies become PGP/MIME multipart/signed (RFC 3156 s5,
  detached signature over the exact content entity bytes); encrypted copies
  are signed inside the encryption (combined method)
- SMIME: plaintext copies become S/MIME multipart/signed (RFC 8551, via
  Bouncy Castle bcjmail); encrypted copies are S/MIME-signed, then
  PGP/MIME-encrypted
- signed bodies are attached as raw bytes so they reach the wire unchanged;
  shared MIME helpers move to MimeEntities
- keys are validated at startup (signing capability, address match,
  validity, passphrase / key-certificate match)
- mail.pgp.signing.required refuses mail from addresses without a key
  (MailSigningException); RELAY mode signs before handing over
- SendReport.signature(), metric tag signature, refused{cause}
- core test-jar shares key/certificate and verification helpers
- end-to-end tests verify signatures on the bytes received over SMTP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G71TQ5jDETVwdUJxGAwaiT

docs/PLAN.md

@@ -172,6 +172,23 @@ Actuator is optional; when the `pgpkeys` endpoint is exposed
 
 Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache) and `SecureMailSenderCustomizer`.
 
+## Signing (M9)
+
+`mail.pgp.signing.type`: `NONE` (default), `OPENPGP` or `SMIME`; one key per From address.
+
+- **OPENPGP** — plaintext copies: `multipart/signed; protocol="application/pgp-signature"; micalg=pgp-<hash>`, detached
+  signature over the exact bytes of the content entity (RFC 3156 section 5). Encrypted copies: signature inside the
+  encryption (RFC 3156 section 6.2, combined method).
+- **SMIME** — plaintext copies: `multipart/signed; protocol="application/pkcs7-signature"` with the certificate chain
+  (Bouncy Castle `bcjmail`, RFC 8551). Encrypted copies: the S/MIME-signed entity is PGP/MIME-encrypted.
+- Signed bodies are attached as raw bytes and the signed part is a parsed MIME part, so JavaMail writes them back byte
+  for byte; tests verify signatures on the bytes received over SMTP, and the output was checked with `gpg --verify` and
+  `openssl smime -verify`.
+- Keys are validated at startup (can sign, names the address, currently valid, passphrase/private key works).
+- `required=true` refuses mail from an address without a key (`MailSigningException`, metric
+  `mail.pgp.refused{cause=signing_required}`); otherwise it is sent unsigned with a warning.
+- RELAY mode signs before handing the message to the gateway.
+
 ## Milestones
 1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 25). ✅
 2. **WKD discovery + cache** — `WkdKeyDiscovery`, `HttpWkdFetcher`, `CachingKeyDiscovery`, static/composite discovery,
@@ -193,3 +210,4 @@ Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache)
    `test@thinhha.pro` → found via advanced method, fpr `ADA6EFA0CC1630D602889820112495670FF1B4F0`.
 8. **Hardening** — Micrometer metrics, protected headers (RFC 9788, opt-in), actuator endpoint, docs. ✅
    Encrypting no longer regenerates the caller's Message-ID.
+9. **Signing** — OpenPGP and S/MIME signing, configurable per application. ✅