v2.4.149 – v2.5.1 — 2026-07-02

• fix: remove unused message binding in SystemSSLSection (build error)
• feat: move panel/mail SSL configuration into the SSL section
• fix: Dovecot offers PLAIN+LOGIN SASL (not only PLAIN)
• refactor: remove autoresponder — out-of-office runs via Roundcube (managesieve)
• feat: mail access services (IMAP/POP3/587/465) toggleable in mail settings
• feat: harden TLS chain — preferred-chain ISRG Root X1 + leaf-only regression guard
• feat: preferred-chain X1 retroactively into existing certbot renewal configs
• feat: webmail password self-management (Roundcube password plugin)
• feat: ARC sealing as an enconf-managed feature (forwarding/distribution + DMARC)
• docs: SRS + ARC sealing on docs.enconf.com (Admin -> Email)
• fix: malware scan timeout generous + configurable (large sites)
• fix: libsasl2-modules for relay SASL auth (smarthost/gateway)
• fix: panel URL SSL — auto issuance, visibility on /ssl, setup redirect
• feat: TLS registry for system certs + notifications SMTP UX (local/external)