feat(mail): seed postmaster@mail.fhirworx.io for DMARC reports

Added DMARC record at _dmarc.fhirworx.io with rua/ruf pointing here.
Apex MX is Proton, so postmaster@fhirworx.io routes off-stack —
postmaster@mail.fhirworx.io (Maddy's MX) gets the reports instead.

Future seed runs auto-provision it; idempotent.

src/mail/droplet.py

@@ -406,6 +406,7 @@ def attach_smarthost() -> None:
 #     by another provider (e.g. Proton at the apex)
 DEFAULT_MAILBOXES = (
     f"postmaster@{DOMAIN}",
+    f"postmaster@{HOSTNAME}",  # DMARC rua/ruf destination; apex MX is Proton
     f"git@{DOMAIN}",  # Gitea's outbound SMTP submission AS this user
     f"cmsupdates@{HOSTNAME}",  # CMS list signups — MX must reach our Maddy
 )