Follow up on postfix-sasl and apache-noscript watch items

Both were left as "revisit if it escalates" notes from earlier audits.
Checked live logs on alpha via SSH (port 10022): postfix-sasl remains
scattered low-volume noise, not a coordinated low-and-slow campaign like
the dovecot spray; the original three /24s behind the apache-noscript
distributed scan are no longer active, current activity is normal
per-IP jail behavior. No fixes needed for either; also reconfirmed the
dyndns per-user auth binding gap is still present and unfixed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

TODO.md

@@ -280,6 +280,13 @@ Nothing here is urgent; all are low-risk, no-downtime changes.
       default thresholds and mail stack but showed much lower per-IP volume
       in this pass — worth a follow-up check if it starts trending the same
       way.
+      **Follow-up 2026-07-26**: checked `postfix-sasl` — still just scattered
+      background noise, not a coordinated campaign. Top offender
+      (`172.94.9.203`) logged 32 hits but all from late June/early July, none
+      since; current activity is single/double attempts from many different
+      IPs (no repeated per-IP low-and-slow pattern like the dovecot spray).
+      `findtime=30m`/`maxretry=3` defaults left as-is — no fix needed unless
+      this changes.
       Fixed: `/etc/fail2ban/jail.d/dovecot-findtime.local`, same values as
       the `sshd` fix (`findtime=1d`, `maxretry=4`, `bantime=1d`). Applied via
       `fail2ban-client reload dovecot`; verified live with