Land 10.0.3 changes on master (#785)

PR #784 was stacked on the #783 branch and its base was never retargeted to
master, so it merged into fix/mailsuite-2.2.1-empty-address instead of master.
master therefore has 10.0.2 (#783's squash) but is missing the 10.0.3 changes.

This re-lands exactly that delta — the Reply-To/Delivered-To parser fix, the
ES/OS Reply-To header flattening, and the Splunk/OpenSearch/Grafana failure
dashboard fixes, with the version bumped to 10.0.3. No mailsuite re-bump (the
>=2.2.1 floor is already on master from 10.0.2).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_postgres.py

@@ -665,6 +665,39 @@ class TestPostgreSQLClientSave(unittest.TestCase):
         self.assertEqual(len(addr_sqls), 1)
         self.assertIn("solo@example.com", addr_sqls[0][1])
 
+    def test_save_failure_report_indexes_reply_to_address(self):
+        """A parsed Reply-To address is written to
+        dmarc_failure_sample_address with address_type 'reply_to' — the
+        rows the Grafana PostgreSQL failure panel aggregates for its
+        'Reply To' column. Guards the path that parse_email now
+        populates (reply_to was always [] before the hyphen-key fix)."""
+        client, mock_conn = _make_client()
+        cur = _mock_cursor(mock_conn, [None, (1,)])
+
+        report = {
+            "arrival_date_utc": "2024-01-15 10:30:00",
+            "reported_domain": "example.com",
+            "source": {"ip_address": "203.0.113.1"},
+            "parsed_sample": {
+                "subject": "Test",
+                "reply_to": [
+                    {"display_name": "Real One", "address": "real@phish.example"}
+                ],
+            },
+        }
+
+        client.save_failure_report_to_postgresql(report)
+
+        reply_to_inserts = [
+            _named_params(c)
+            for c in cur.execute.call_args_list
+            if "dmarc_failure_sample_address" in c.args[0]
+            and c.args[1][1] == "reply_to"
+        ]
+        self.assertEqual(len(reply_to_inserts), 1)
+        self.assertEqual(reply_to_inserts[0]["address"], "real@phish.example")
+        self.assertEqual(reply_to_inserts[0]["display_name"], "Real One")
+
 
 class TestPostgreSQLSaveErrors(unittest.TestCase):
     """Driver errors raised mid-save are wrapped in PostgreSQLError."""