docs: exim filter must match 535 only; 435 is an auth-backend fault
docs: add complete wiki (19 pages): project guide, Fail2Ban deep dive and agent prompts