feat(maddy): upgrade image to v0.9.5

[enwaiax]

Summary

Upgrades the maintained Maddy image from the pinned 2022-era v0.5.4 snapshot to the upstream v0.9.5 release.

Image

• updates the Maddy submodule to the exact v0.9.5 tag (58e8a114…);
• moves the builder to Go 1.23 and the runtime to Alpine 3.21.2;
• uses the upstream Docker configuration instead of patching maddy.conf with sed;
• injects the explicit v0.9.5 version into build.sh, so image builds do not depend on unavailable submodule Git metadata;
• adds OCI metadata labels and preserves optional upstream build tags;
• adopts the current single-binary management command (maddy creds, maddy imap-acct).

Deployment documentation

• pins examples and Compose to enwaiax/maddy:0.9.5;
• documents the current TLS paths: /data/tls/fullchain.pem and /data/tls/privkey.pem;
• restores the missing port 465 mapping in Compose;
• updates the website catalog to show the pinned upstream release.

Verification

• Dockerfile passes Buildx checks and Hadolint error threshold;
• Compose configuration parses successfully;
• AMD64 image builds and reports:

v0.9.5 linux/amd64 go1.23.12

• OCI labels, entrypoint, and run command were inspected;
• volume initialization installs the upstream Docker config with environment-driven hostname/domain and current TLS paths;
• management subcommands creds and imap-acct are present;
• an actual AMD64 + ARM64 OCI image build completed, and the exported index contains both linux/amd64 and linux/arm64;
• Astro check/build, npm audit, and documentation links pass.

Publishing impact

This PR does not publish Docker Hub tags. After merge, run the manual supply-chain workflow on main with publish: false first. A separate explicit decision is still required before publishing 0.9.5 or replacing latest.