Fix Dovecot passwd-file format and document mbox mail import

- passwd.j2: append '::::::' so entries have full 8-field passwd format.
  Without this Dovecot's userdb lookup fails ('user is missing userdb
  info') even though passdb auth succeeds, causing login to return 401.
- main.yml: fix passwd file mode from 0640 to 0644 so Dovecot can read it.
- Add runbook-mail-import.md: full procedure for migrating mbox-format mail
  (old Dovecot server with ~/mail/ flat files) to Maildir++ including the
  conversion script that handles fetchmail >From envelope lines.
- runbook-configuration.md: reference new runbook in the mail import section.

docs/runbook-configuration.md

@@ -183,17 +183,20 @@ ansible-playbook -i ansible/inventory.ini ansible/site.yml --tags mail --ask-vau
 
 ### 5.1 Import mail from an old Dovecot server
 
-If migrating from an existing Dovecot server, sync the Maildir directly:
+If the old server uses **Maildir** format, rsync directly:
 
 ```bash
 # Run on the old server — syncs to the new server's maildir volume
-rsync -av --progress /var/mail/alice/Maildir/ \
+rsync -av -e "ssh -i keys/root_cloud_ladkau_de" --progress ./* \
   root@217.154.207.148:/opt/mail/maildir/alice/Maildir/
 
 # Fix ownership for Dovecot's vmail user (UID 5000)
-ssh root@217.154.207.148 "chown -R 5000:5000 /opt/mail/maildir/alice"
+ssh -i keys/root_cloud_ladkau_de root@217.154.207.148 "chown -R 5000:5000 /opt/mail/maildir/alice"
 ```
 
+If the old server uses **mbox** format (e.g. `mail_location = mbox:~/mail:...`),
+see `runbook-mail-import.md` for the conversion procedure.
+
 Alternatively, use `imapsync` to copy via IMAP from the old server to the
 new one (works without direct server access):