Email authentication refinements

[Jaro-c]

Follow-ups to the SPF/DKIM/DMARC chain shipped in #45/#47/#49/#51:

• SPF macros beyond the basic set; exists and ptr mechanisms
• Public-suffix list for exact organizational-domain alignment (current 2-label heuristic is wrong for e.g. co.uk)
• DKIM x= expiration enforcement and rsa-sha256 signing (verify-only today)
• DMARC pct= sampling and aggregate (rua) report generation
• Authentication-Results header unfolding/quoting per RFC 8601 edge cases