feat(recon): add postfixadmin setup and panel fingerprints (#292)

detect a reachable postfixadmin setup.php (unhardened-install signal
and info disclosure, not an auth bypass since superadmin creation is
gated on a locally configured setup password) and the login panel.
markers and the setup-password form field and login field pair with
the brand string so prose mentions do not match.

modules/info/postfixadmin-panel.yaml

@@ -0,0 +1,42 @@
+# PostfixAdmin Login Panel Detection Module
+
+id: postfixadmin-panel
+info:
+  name: PostfixAdmin Login Panel
+  author: sif
+  severity: info
+  description: Detects an exposed PostfixAdmin mail admin login panel
+  tags: [postfixadmin, mail, mailserver, admin, panel, login, detection, info]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/login.php"
+    - "{{BaseURL}}/postfixadmin/login.php"
+
+  matchers:
+    - type: word
+      part: body
+      condition: and
+      words:
+        - 'name="fUsername"'
+        - 'name="fPassword"'
+
+    - type: regex
+      part: body
+      regex:
+        - "(?i)postfix\\s*admin"
+
+    - type: status
+      status:
+        - 200
+
+  extractors:
+    - type: regex
+      name: postfixadmin_version
+      part: body
+      regex:
+        - "Postfix Admin ([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)"
+      group: 1

modules/recon/postfixadmin-setup-exposure.yaml

@@ -0,0 +1,38 @@
+# PostfixAdmin Setup Page Exposure Detection Module
+
+id: postfixadmin-setup-exposure
+info:
+  name: PostfixAdmin Setup Page Exposure
+  author: sif
+  severity: medium
+  description: Detects a reachable PostfixAdmin setup.php that discloses hosting/environment checks and install state unauthenticated. Since PostfixAdmin 2.3 the setup password gate blocks remote superadmin creation without the configured setup_password, so this is an information-disclosure and unhardened-install signal rather than a direct authentication bypass.
+  tags: [postfixadmin, mail, mailserver, admin, setup, install, exposure, recon]
+
+type: http
+
+http:
+  method: GET
+  paths:
+    - "{{BaseURL}}/setup.php"
+    - "{{BaseURL}}/postfixadmin/setup.php"
+
+  matchers:
+    - type: word
+      part: body
+      condition: and
+      words:
+        - 'name="setup_password"'
+        - "Postfix Admin"
+
+    - type: status
+      status:
+        - 200
+
+  extractors:
+    - type: regex
+      name: postfixadmin_setup_state
+      part: body
+      regex:
+        - "(You need to have a setup_password hash configured)"
+        - "(setup_password configured)"
+      group: 1