feat(mailu): add ops.py + backup/restore tests + update PARITY.md (P4 now covered via PR#3)

tests/mailu/PARITY.md

@@ -28,13 +28,21 @@ email stack: nginx front + admin + postfix/smtp + dovecot/imap + rspamd/antispam
    network IMAP-auth test was dropped: under notls dovecot disallows plaintext network auth, so a
    host-side login is not a meaningful signal here.)
 
-## Backup data-integrity (P4) — N/A (recipe ships no backup config)
-The upstream mailu recipe declares **no `backupbot.backup` label** on any service, so the cc-ci
-backup/restore tiers cleanly SKIP (`backup_capable=False`). There is no recipe backup mechanism to
-exercise — P4 is genuinely N/A for mailu as published, not a cut corner. The durable fix (if P4
-coverage is wanted) is a recipe-PR adding backupbot labels (mailu admin sqlite at /data + mail
-volume), filed as a deferral mirroring the immich Q3.5 / Q3.2b pattern — see DEFERRED.md. Pending
-Adversary §7.1 sign-off on the N/A.
+## Backup data-integrity (P4) — COVERED (phase-mailu, 2026-06-11)
+
+P4 is now **earned** via recipe-mirror PR#3 (`add-backupbot-labels`) on
+`git.autonomic.zone/recipe-maintainers/mailu`. That PR adds backupbot v2 labels to the `admin`
+service (`/data` — sqlite DB) and `imap` service (`/mail` — Maildir), making `backup_capable=True`
+at the PR head.
+
+cc-ci tests (all in `tests/mailu/`):
+- `ops.py` — `pre_backup`: seeds `citest@<domain>` via `flask mailu user`; `pre_restore`: deletes
+  it via sqlite3 Python to simulate data loss.
+- `test_backup.py` — asserts `citest@<domain>` is in `config-export` at backup time.
+- `test_restore.py` — asserts `citest@<domain>` is back in `config-export` after restore.
+
+Auto-detected: `generic.backup_capable()` scans the compose.yml for `backupbot.backup.*true` and
+returns `True` at the PR head — no `BACKUP_CAPABLE` override needed in `recipe_meta.py`.
 
 ## Browser flow (P6)
 Not added: mailu's user-facing UX (webmail/admin) is a standard web UI; the characteristic behaviour