Ubuntu – Postfix: Allow unauthenticated incoming mail, but only authenticated outgoing mail

I think you need to put mydestination = mydomain.com in your config.

Next guess: We know the domain is right and that SASL works... so what I now suspect is that we're seeing an error in your restrictions. I'd start with recipient_restrictions and remove every rejection after permit_sasl_authenticated. If that works, add them back one at a time. If not, your next test is sender_restrictions.

1)
To make smtpd listen on an alternate port, you modify master.cf copy the existing smtpd entry and just change the first field from smtp to 587 or whatever port you want to listen on. If you want to use port 465, uncomment the smtps entry. I would not advise using unecrypted smtp on this port as it will likely just cause confusion and problems with mail clients (since 465 is designated as an ssl port).
The option your looking for to enable authentication is smtpd_sasl_auth_enable=yes and smtpd_recipient_restrictions=permit_sasl_authenticated (which you already have, so you just need to configure it). As you have these settings in your main.cf, they are enabled for all ports. There is no reason to only allow them on ports other than 25. If the mail comes through unauthenticated, then it will only be accepted for local delivery. If it comes through authenticated, it can go anywhere.

I'm not sure what you mean by 'why doesn't the SMTP have a reject restriction?'.

2)
You have to use SASL for authentication. So authentication is provided by an external service which postfix talks to. You can still use your existing MySQL database, you just need to configure an SASL service to use it. Cyrus SASL is the default provider in postfix. More can be read here.

3)
You already have smtpd_recipient_restrictions = permit_mynetworks, and mynetworks = 127.0.0.0/8, so anything from localhost will be accepted, including PHP.

NOTE I advise looking at all the options available for smtpd_recipient_restrictions. Just setting this to the values provided here and nothing else can cause undesired behavior. I'd read the postconf man page on all the settings I mentioned so that you understand what theyre doing before you implement them.