BREAKING CHANGE(rust-bridge): make Rust the primary security backend, remove all TS fallbacks

Phase 3 of the Rust migration: the Rust security bridge is now mandatory
and all TypeScript security fallback implementations have been removed.

- UnifiedEmailServer.start() throws if Rust bridge fails to start
- SpfVerifier gutted to thin wrapper (parseSpfRecord stays in TS)
- DKIMVerifier gutted to thin wrapper delegating to bridge.verifyDkim()
- IPReputationChecker delegates to bridge.checkIpReputation(), keeps LRU cache
- DmarcVerifier keeps alignment logic (works with pre-computed results)
- DKIM signing via bridge.signDkim() in all 4 locations
- Removed mailauth and ip packages from plugins.ts (~1,200 lines deleted)

ts/mail/delivery/classes.delivery.system.ts

@@ -12,6 +12,7 @@ import { UnifiedDeliveryQueue, type IQueueItem } from './classes.delivery.queue.
 import type { Email } from '../core/classes.email.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 import type { SmtpClient } from './smtpclient/smtp-client.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 
 /**
  * Delivery status enumeration
@@ -763,33 +764,24 @@ export class MultiModeDeliverySystem extends EventEmitter {
     try {
       // Ensure DKIM keys exist for the domain
       await this.emailServer.dkimCreator.handleDKIMKeysForDomain(domainName);
-      
+
+      // Get the private key
+      const dkimPrivateKey = (await this.emailServer.dkimCreator.readDKIMKeys(domainName)).privateKey;
+
       // Convert Email to raw format for signing
       const rawEmail = email.toRFC822String();
-      
-      // Sign the email
-      const dkimPrivateKey = (await this.emailServer.dkimCreator.readDKIMKeys(domainName)).privateKey;
-      const signResult = await plugins.dkimSign(rawEmail, {
-        signingDomain: domainName,
+
+      // Sign via Rust bridge
+      const bridge = RustSecurityBridge.getInstance();
+      const signResult = await bridge.signDkim({
+        rawMessage: rawEmail,
+        domain: domainName,
         selector: keySelector,
         privateKey: dkimPrivateKey,
-        canonicalization: 'relaxed/relaxed',
-        algorithm: 'rsa-sha256',
-        signTime: new Date(),
-        signatureData: [
-          {
-            signingDomain: domainName,
-            selector: keySelector,
-            privateKey: dkimPrivateKey,
-            algorithm: 'rsa-sha256',
-            canonicalization: 'relaxed/relaxed'
-          }
-        ]
       });
-      
-      // Add the DKIM-Signature header to the email
-      if (signResult.signatures) {
-        email.addHeader('DKIM-Signature', signResult.signatures);
+
+      if (signResult.header) {
+        email.addHeader('DKIM-Signature', signResult.header);
         logger.log('info', `Successfully added DKIM signature for ${domainName}`);
       }
     } catch (error) {