Summary

• Every outbound email now carries a signature appended to the body before DKIM signing. Default is Sent from AIMX.\nhttps://aimx.email.
• Operators override via the new top-level signature key in config.toml — omit for the built-in default, set a string to customize, or set "" to disable. Implemented as Option<String> to match existing Option<T> "default + override" precedents (verify_host, upgrade, per-mailbox trust / trusted_senders); rejected the alternative of a separate disable_signature boolean since the codebase has no such precedent and one field naturally encodes all three states.
• Injection happens daemon-side (send_handler::append_signature, called between inject_message_id_header and DKIM signing) so the same behavior applies uniformly to aimx send, email_send, and email_reply. Multipart messages get the signature inside the first text/plain part (before the next boundary); flat text messages get it appended to the body. Malformed multipart falls back to end-of-body append so DKIM signing stays deterministic.
• Config is hot-swappable via ConfigHandle, so editing signature takes effect on the next send without restarting aimx serve.

Test plan

• cargo build — clean
• cargo clippy -- -D warnings — clean
• cargo fmt -- --check — clean
• cargo test — 1050 unit + 106 integration tests pass; 0 failures
• New unit tests for append_signature, extract_multipart_boundary, and find_first_part_terminator (11 tests covering empty-signature noop, text/plain end-append, multipart text-part injection, LF terminator preservation, multibyte signatures, malformed-multipart fallback, quoted/unquoted/case-insensitive boundary parsing)
• New daemon-level tests through handle_send (4 tests covering default-when-omitted, custom override, empty disables, and signature-lands-in-text-part for multipart)
• Default-signature assertion added to the existing send_uds_end_to_end_delivers_signed_message integration test (real aimx serve + aimx send round-trip via the file-drop mail transport)
• Manual verification path documented in book/configuration.md under the new "Outbound signature" section