feat: relay selector with init/on_failure script

[weavedwires]

What

Replaces the built-in transport ordering (sorted_transports + the
smtp_success table) with a user-definable Rhai script that decides which
relay is activated for sending. The core no longer picks or caches relays — it
asks the script. A built-in default script implementing the standard
ping-and-failover algorithm is used when no user script is installed.

Script contract

Two functions are required:

• init(relays) -> addr | () — called when a relay is needed and the previous
  attempt did not fail (first run, restart, or a stale reconnect). It may
  return the remembered relay for a fast start.
• on_failure(relays, bad_relay) -> addr | () — called after the previously
  selected relay failed, with the failed relay as the second argument.

relays is an array of object maps, one per configured transport:
#{ id, addr, host, added }.

Available host functions inside the functions:

• ping(host) -> int — TCP connect to port 443, returns RTT in ms, throws on
  failure (catchable with try/catch). Only hosts from the current relay
  set can be pinged.
• state_get(key) / state_set(key, value) — persistent state, stored in
  the relay_selector table and surviving restarts.
• mem_get(key) / mem_set(key, value) — volatile state, kept in memory
  for the process lifetime and cleared on restart.
• now(), log(message).

Splitting persistent and volatile state lets the default script keep its ping
cache (order) volatile and only its current/bad lists persistent.

Core flow

Smtp::connect_configured() is the only place that asks the selector:

• stale reconnect (>60s) / restart → init(relays);
• failed connect/auth/send → on_failure(relays, last_bad).

The core keeps only a transient failed/bad flag; the active relay lives in the
script's current. On a successful live connection the script is not called at
all.

Default script

• init(): if current is set and still among the relays, return it (fast
  start, no pings); otherwise ping all relays, sort by ascending RTT
  (tie-break by id), pick the fastest.
• on_failure(relays, bad_relay): add bad_relay to bad, return the next
  fastest; when all relays are known bad (or the volatile cache was lost on
  restart), reset and re-ping.

API

set_relay_selector, get_relay_selector ({ script, state, isDefault }) and
reset_relay_selector_state over JSON-RPC and the C FFI, plus Python client
wrappers. Setting None restores the built-in default. Setting a different
script resets its state; an identical script keeps it. Scripts are validated to
define both functions.

Storage

• New table relay_selector(id, script, is_default, state).
• smtp_success and record_success are removed; migration 170 drops the
  table and reshapes relay_selector.

Notes

• ping() targets TCP port 443 on the relay host, which is the mail port for
  chatmail relays and a reasonable reachability proxy otherwise.
• A test-only per-context switch keeps ping() offline in the Rust test suite.

Tests

• Unit tests for the default script (fast start, cold start with no reachable
  relay, failover/demotion) and for set/get/reset.
• cargo check --workspace, cargo clippy --all-targets clean; SQL schema docs
  updated.

[link2xt]

Do not use "AI" to create PRs here.
Read https://delta.chat/en/community-standards#collective-maintenance-standards

Not to say that this is not the feature we want, and we don't want a dependency on the script interpreter.