feat: harden SMTP transport

Add explicit TLS modes, context-aware delivery, and typed transport errors.
Preserve raw MIME messages and cover the new delivery paths with local SMTP tests.

.golangci.yml

@@ -1,79 +1,83 @@
+version: "2"
 run:
   tests: false
-  timeout: 3m
-  skip-dirs:
-    - cmd/local
-
 linters:
   enable:
-    - errcheck
-    - gosimple
-    - govet
-    - ineffassign
-    - staticcheck
-    - typecheck
-    - unused
-    - unconvert
     - gocritic
-    - exportloopref
-    - whitespace
     - misspell
-    - thelper
     - revive
-
-linters-settings:
-  errcheck:
-    exclude-functions:
-      - (*github.com/gin-gonic/gin.Context).AbortWithError
-      - (*github.com/gin-gonic/gin.Context).Error
-      - (github.com/gin-gonic/gin.ResponseWriter).WriteString
-      - (net/http.ResponseWriter).Write
-      - fmt.Fprintf
-      - fmt.Fprintln
-      - (*github.com/jlaffaye/ftp.Response).Close
-      - (*github.com/jlaffaye/ftp.ServerConn).Quit
-      - (golang.org/x/crypto/ssh.Conn).Close
-      - (*github.com/pkg/sftp.File).Close
-      - (*github.com/pkg/sftp.clientConn).Close
-      - (*compress/gzip.Reader).Close
-      - (io.Closer).Close
-      - (*os.File).Close
-      - (io/fs.File).Close
-      - (*github.com/gocraft/work.Enqueuer).Enqueue
-      - (*encoding/xml.Encoder).EncodeToken
-      - (*encoding/xml.Encoder).EncodeElement
-      - (*encoding/xml.Encoder).Flush
-      - (*encoding/xml.Encoder).Encode
-      - (io.Writer).Write
-      - (*encoding/csv.Writer).Write
-      - os.Remove
-      - (*os.File).Seek
-      - (*os.File).WriteString
-      - (*go.uber.org/zap.Logger).Sync
-      - io.Copy
-
-  revive:
-    rules:
-      - name: var-naming
-        severity: error
-        disabled: false
-  gocritic:
-    enabled-tags:
-      - diagnostic
-      - style
-      - performance
-    disabled-checks:
-      - singleCaseSwitch
-      - unnecessaryBlock
-      - unnamedResult
-      - paramTypeCombine
-      - emptyStringTest
-      - regexpSimplify
-      - preferStringWriter
-      - badRegexp
-      - emptyFallthrough
-      - unlabelStmt
-      - nestingReduce
-      - hugeParam
-      # TODO: enable after testing
-      - rangeValCopy
+    - thelper
+    - unconvert
+    - whitespace
+  settings:
+    errcheck:
+      exclude-functions:
+        - (*github.com/gin-gonic/gin.Context).AbortWithError
+        - (*github.com/gin-gonic/gin.Context).Error
+        - (github.com/gin-gonic/gin.ResponseWriter).WriteString
+        - (net/http.ResponseWriter).Write
+        - fmt.Fprintf
+        - fmt.Fprintln
+        - (*github.com/jlaffaye/ftp.Response).Close
+        - (*github.com/jlaffaye/ftp.ServerConn).Quit
+        - (golang.org/x/crypto/ssh.Conn).Close
+        - (*github.com/pkg/sftp.File).Close
+        - (*github.com/pkg/sftp.clientConn).Close
+        - (*compress/gzip.Reader).Close
+        - (io.Closer).Close
+        - (*os.File).Close
+        - (io/fs.File).Close
+        - (*github.com/gocraft/work.Enqueuer).Enqueue
+        - (*encoding/xml.Encoder).EncodeToken
+        - (*encoding/xml.Encoder).EncodeElement
+        - (*encoding/xml.Encoder).Flush
+        - (*encoding/xml.Encoder).Encode
+        - (io.Writer).Write
+        - (*encoding/csv.Writer).Write
+        - os.Remove
+        - (*os.File).Seek
+        - (*os.File).WriteString
+        - (*go.uber.org/zap.Logger).Sync
+        - io.Copy
+    gocritic:
+      disabled-checks:
+        - singleCaseSwitch
+        - unnecessaryBlock
+        - unnamedResult
+        - paramTypeCombine
+        - emptyStringTest
+        - regexpSimplify
+        - preferStringWriter
+        - badRegexp
+        - emptyFallthrough
+        - unlabelStmt
+        - nestingReduce
+        - hugeParam
+        - rangeValCopy
+      enabled-tags:
+        - diagnostic
+        - style
+        - performance
+    revive:
+      rules:
+        - name: var-naming
+          severity: error
+          disabled: false
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$