inbuxa:ProtocolPolicy, the switch itself

The server-wide legacy-protocols policy: the switch, whether submission
closes with it, the listeners taken away to honour it, and who last
changed it. Stored like inbuxa:AiLimits, as JSON in the fork's subspace,
so an unset field reads as its default and an old record still loads.

closes() is where LP-3 lives. imap, pop3 and manageSieve are named
outright; smtp is not, because an SMTP listener is inbound or submission
depending on its port and nothing else can tell them apart. A listener
bound to 25 is inbound whatever it is called, including one that also
binds 465, so it stays. http and lmtp are never candidates at all.

savedListeners keeps each listener's registry object whole rather than a
few fields of it. LP-5 promises the listeners come back exactly as they
were, and a listener carries proxy networks, TLS timeouts and socket
options that no one should have to re-derive -- a field this code has
never heard of has to survive the round trip too, and a test holds that.

The module is under security/ rather than beside the rebuilt features,
because this one is not a rebuild: upstream has nothing like it.

Still only a fact. Nothing reads this policy yet, so no port closes and
no sign-in is refused; the acting code needs the listener registry and
the config store, which live above this crate.

crates/features/src/security/mod.rs

@@ -0,0 +1,13 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+//! Security hardening INBUXA adds of its own.
+//!
+//! Unlike the rest of this crate, these are not rebuilds of anything upstream
+//! ships. The legacy-protocols switch is INBUXA's own design, specified in
+//! `legacy-protocols.md`.
+
+pub mod protocol_policy;