feat(2): Q4.9 mailu — recipe_meta + health + 3 functional (create-mailbox/imap-login/mail-flow); P4 N/A deferred

mailu (full email stack). TLS_FLAVOR=notls avoids certdumper/ACME dep (cc-ci file-provider cert);
MAIL_DOMAIN/HOSTNAMES=run domain; TRAEFIK_STACK_NAME for the letsencrypt-volume mount. P2 vacuous (no
corpus). P3: test_mailbox (flask mailu user create + config-export read-back), test_imap_login
(mailbox authenticates over dovecot IMAP:143), test_mail_flow (SMTP submission send → IMAP retrieve,
auth to avoid greylisting). P4 N/A (no backupbot label) — DEFERRED.md + PARITY.md, Adversary §7.1
sign-off pending. Smoke-validated: 8 services converge, mail ports 25/587/143/993 host-open, flask CLI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/mailu/functional/test_mailbox.py

@@ -0,0 +1,29 @@
+"""mailu — recipe-specific functional test #1 (Phase 2 P3 §4.3 create-an-object + read-back).
+
+Create a mailbox (the characteristic mailu object) via the admin CLI, then read it back from the
+authoritative config export and assert it is present. Real create→persist→read-back, not health-only.
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+import uuid
+
+sys.path.insert(0, os.path.dirname(__file__))
+import _mailu  # noqa: E402
+
+
+def test_create_mailbox_and_read_back(live_app):
+    mail_domain = live_app  # recipe_meta sets MAIL_DOMAIN = the per-run domain
+    local = "ccci-" + uuid.uuid4().hex[:8]
+    password = "CcCi-" + uuid.uuid4().hex[:16] + "-Aa1!"
+
+    _mailu.ensure_domain(live_app, mail_domain)
+    email = _mailu.create_user(live_app, local, mail_domain, password)
+
+    cfg = _mailu.config_export(live_app)
+    emails = _mailu.user_emails(cfg)
+    assert email in emails, (
+        f"created mailbox {email} not present in mailu config-export users {emails}"
+    )