Relay-domain lookup failure silently re-enables local DKIM signing; GetRelayDomains ignores ctx (40c23d02)

Two robustness points in 40c23d02 ("Fix #289: skip DKIM signing for relay-mapped domains"), in core/internal/service/domains/domains.go.

1. A failed relay lookup silently reintroduces #289

getDKIMRecordWithKeySize:

relayDomains, relayErr := GetRelayDomains(context.Background())
if relayErr != nil {
    g.Log().Warning(context.Background(), "Failed to check relay domains for DKIM signing:", relayErr)
    relayDomains = make(map[string]bool)
}

if !relayDomains[domain] {
    // ... write signing config, restart rspamd
}

On a transient database error the set becomes empty, so a relay-mapped domain is signed locally after all — producing the duplicate DKIM-Signature header that #289 reports, with only a warning in the log.

Failing open is arguably the safer default (unsigned mail is worse than double-signed), but it is currently implicit. If it is intentional, a comment stating the trade-off would help; if not, the caller probably wants to skip the config rewrite rather than assume "no relays".

RepairDKIMSigningConfig has the same pattern, and is explicit about it — "Failed to get relay domains, signing all" — so the two are at least consistent.

2. GetRelayDomains(ctx) ignores its context

func GetRelayDomains(ctx context.Context) (map[string]bool, error) {
    ...
    err := g.DB().Model("bm_relay_domain_mapping rdm").
        LeftJoin("bm_relay_config rc", "rc.id = rdm.relay_id").
        Where("rc.active", 1).
        ...

No .Ctx(ctx), unlike Exists() immediately below it, so cancellation and tracing do not propagate. Both current call sites pass context.Background() anyway, which hides it — but the parameter currently promises something it does not do.