mail: stop treating member email domains as local; pin DMS 15.1.0

The LDAP domain filter matched every entry with a mail attribute, so
membership accounts with external addresses (e.g. @gmail.com) made
those domains local and outbound mail to them bounced with 550 5.1.1.
Restrict the filter to the Postfix Users group, like the user filter.

Pin docker-mailserver to 15.1.0: v17 renamed the LDAP_QUERY_FILTER_*
variables and chowns /var/mail to 5000:5000 at startup, which breaks
this LDAP uid-per-mailbox setup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/mail.yaml

@@ -142,7 +142,7 @@
           spec:
             containers:
               - name: mail
-                image: mailserver/docker-mailserver
+                image: mailserver/docker-mailserver:15.1.0  # pinned: v17 renamed LDAP env vars and breaks this config
                 securityContext:
                   # `allowPrivilegeEscalation: true` is required to support SGID via the `postdrop`
                   # executable in `/var/mail-state` for Postfix (maildrop + public dirs):
@@ -212,7 +212,8 @@
                   - name: LDAP_BIND_PW
                     value: "{{ openldap_readonly_password }}"
                   - name: LDAP_QUERY_FILTER_DOMAIN
-                    value: "(mail=*@%s)"
+                    # Only mailbox users define local domains; member accounts carry external addresses (e.g. @gmail.com).
+                    value: "(&(mail=*@%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
                   - name: LDAP_QUERY_FILTER_USER
                     value: "(&(mail=%s)(memberOf=cn=Postfix Users,ou=Postfix,ou=Services,dc=eom,dc=dev))"
                   - name: LDAP_QUERY_FILTER_ALIAS