Email trigger from rule exact domain matching

An email trigger's `from` rule is a case-insensitive substring of the From address (`apps/api/app/trigger_intake.py::email_matches`). A rule `from: boss@victim.com` also matches `boss@victim.com.evil.example`, a domain the sender owns, so it passes DMARC legitimately and fires the sender-scoped trigger. Since Task 9431, tenant orgs write `from` rules on their own hosted addresses and Gmail mailboxes, which makes this reachable by any outside sender. Requirement: when a `from` rule names a whole address or a domain (`@victim.com`), match the parsed From address exactly, or its domain exactly or as a subdomain (`== d` or `endswith("." + d)`), not as a substring. Keep plain substring matching only for a rule that is neither an address nor a domain, and say so in the editor's hint. Out of scope: To and Subject rules; system inbound routing; DMARC handling (already enforced for every provider). Done means: - A test in `apps/api/tests/test_ses_inbound.py` (or a new suite) where `from: boss@victim.com` does not match `boss@victim.com.evil.example` with DMARC pass, and still matches `Boss <boss@victim.com>`. - `./dc check quick` green.

Already shipped by Task 9586: From rules match an address exactly and a domain with its subdomains, and the editor hint says so. The evil.example look-alike tests pass (19 passed). No PR. Memory: none applied.