feat(templates): migrate six cred emitters to native shape

Phase 2/3 of DEBT-039. Switches FTP, POP3, IMAP, SMTP, Redis, and
LDAP from the legacy `username=` + `password=` SD-block shape to the
universal credential shape (`principal=` + `secret_printable=` +
`secret_b64=`) the new Credential storage model expects.

Pattern is uniform across all six services:

    _log("auth_attempt", username=u, principal=u, **encode_secret(pw))

Each service emits the canonical SD keys. The ingester's native-shape
branch (introduced in 2f47f67) now writes their cred attempts
directly without going through the legacy adapter. Once Phase 3
removes the adapter the contract becomes single-shape.

Per-service notes:
- POP3 / IMAP — `status="success"|"failed"` renamed to
  `outcome="success"|"failure"` to match Credential.outcome's
  vocabulary; the ingester reads outcome directly.
- SMTP — AUTH path migrated; in addition the existing mail_from
  event now exposes a parsed `domain=` field alongside the original
  `value=` so future "what domains do attackers spoof from" analytics
  have an indexed field. Not stored in Credential — regular Log row.
- Redis — was silently dropped by the legacy adapter (no `username`
  field). Native branch handles `principal=None` correctly. BONUS
  FIX: the Redis 6+ ACL syntax `AUTH <user> <pw>` now captures the
  ACL username as principal (was previously discarded).
- LDAP — was silently dropped by the legacy adapter (no `password`
  recognition for the `bind` event). Now lands as
  `principal=<dn>`. BONUS FIX.

Tests (tests/services/test_cred_emitters.py, 9 cases):
- per-service native-shape ingest path produces correct Credential
  rows; outcome maps for POP3/IMAP; principal=None for legacy Redis
  AUTH; principal=dn for LDAP.
- mail_from event does NOT trigger a credential write (it's a
  Log-only observation, not auth).
- 0xff/NUL/ANSI bytes in passwords survive losslessly through
  secret_b64 even when secret_printable is sanitized.

Phase 3 deletes the legacy adapter once all migrations land — the
adapter has no live emitters to handle anymore.

decnet/templates/smtp/server.py

@@ -32,7 +32,13 @@ from email.header import decode_header, make_header
 from email.message import Message
 
 import instance_seed as _seed
-from syslog_bridge import SEVERITY_WARNING, syslog_line, write_syslog_file, forward_syslog
+from syslog_bridge import (
+    SEVERITY_WARNING,
+    encode_secret,
+    forward_syslog,
+    syslog_line,
+    write_syslog_file,
+)
 
 NODE_NAME   = os.environ.get("NODE_NAME", "mailserver")
 SERVICE_NAME = "smtp"
@@ -355,7 +361,14 @@ class SMTPProtocol(asyncio.Protocol):
         elif cmd == "MAIL":
             addr = args.split(":", 1)[1].strip() if ":" in args else args
             self._mail_from = addr
-            _log("mail_from", src=self._peer[0], value=addr)
+            # Strip <…> wrappers around the address; everything after the
+            # last @ is the domain. Empty when the attacker sent <> or a
+            # malformed envelope; keeping value= for back-compat with any
+            # log query that still reads it.
+            _bare = addr.strip("<>").strip()
+            _domain = _bare.rsplit("@", 1)[-1] if "@" in _bare else ""
+            _log("mail_from", src=self._peer[0], value=addr,
+                 mail_from=_bare, domain=_domain)
             self._transport.write(b"250 2.1.0 Ok\r\n")
 
         elif cmd == "RCPT":
@@ -456,8 +469,8 @@ class SMTPProtocol(asyncio.Protocol):
 
     def _finish_auth(self, username: str, password: str) -> None:
         _log("auth_attempt", src=self._peer[0],
-             username=username, password=password,
-             severity=SEVERITY_WARNING)
+             username=username, principal=username,
+             severity=SEVERITY_WARNING, **encode_secret(password))
         if not OPEN_RELAY:
             self._transport.write(b"535 5.7.8 Error: authentication failed\r\n")
             return