rate limit: domain ceiling for all IPs, trusted app override

Invert level-2 semantics so domain limits apply to every client IP and
application limits with trusted IPs raise the ceiling above the domain
(still capped by level 1). Panel shows L1, validates maxima, and documents
the model on Settings.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/architecture.md

@@ -81,11 +81,13 @@ One process, three roles:
    proxy only.
 2. **journal-milter** — unix socket `JOURNAL_MILTER_SOCKET`; records From/To/
    Subject/SASL user at DATA; enforces level-2 rate limits; **fail-open**
-   (`default_action=accept`) so milter failure does not stop mail. The level-2
-   count is the stored send-log rows plus the messages this process has admitted
-   but not yet written (`internal/milter/inflight.go`), so concurrent sessions
-   cannot each spend the same last slot; a reservation is released at
-   end-of-message, on ABORT, or after a 10-minute TTL.
+   (`default_action=accept`) so milter failure does not stop mail. Domain
+   ceilings apply to every client IP; an application ceiling with trusted IPs
+   raises the limit for those IPs only and skips the domain check (guide § Rate
+   limiting). The level-2 count is the stored send-log rows plus the messages
+   this process has admitted but not yet written (`internal/milter/inflight.go`),
+   so concurrent sessions cannot each spend the same last slot; a reservation
+   is released at end-of-message, on ABORT, or after a 10-minute TTL.
 3. **log-tailer** — follows `MAIL_LOG`, updates send-log delivery status by
    queue-id. Send-log `queued → sent` transitions depend on this goroutine alone
    (`UpdateStatus` is only called from [internal/logtail](../internal/logtail/logtail.go)).

docs/guide.md

@@ -202,7 +202,8 @@ service healthy and will mail be accepted?"
   shows after manual edits under `/data`.
 - **Domains** (`/domains`) — add sending domains, inspect each domain's DKIM
   TXT value, SPF/DMARC checks, and SASL applications. Per-domain rate limits
-  (level 2) are configured here. *Export domain* writes a single-domain archive;
+  (level 2) and trusted-IP application overrides are configured here.
+  *Export domain* writes a single-domain archive;
   *Import a domain* on the Backup page reads one back in.
 - **Deliveries** (`/deliveries`) — searchable send log with server-side filters
   by domain and application. A row identifies its message and nothing more —
@@ -269,8 +270,10 @@ docker compose exec selfpost cat /data/setup-token
 
 ## Rate limiting
 
-SelfPost applies two independent limits; both can refuse a submission, but only
-level 2 writes a `rejected` row in the send log.
+SelfPost applies two independent layers; both can refuse a submission, but only
+level 2 writes a `rejected` row in the send log. Level-2 ceilings set in the
+panel cannot exceed level 1 (the panel shows the level-1 values and rejects
+higher numbers).
 
 **Level 1 (IP backstop)** — always on, configured via `.env`:
 
@@ -278,14 +281,20 @@ level 2 writes a `rejected` row in the send log.
 - `RATE_LIMIT_WINDOW_SECONDS` → Postfix `anvil_rate_time_unit`
 
 This is an anvil limit per connecting client IP. It keeps working even if the
-journal-milter (level 2) is down.
+journal-milter (level 2) is down. There is no per-IP bypass.
 
-**Level 2 (per domain / per application)** — optional, configured in the panel
-on each domain's page or on an individual application. You set a message
-ceiling, a time window, and optionally restrict the limit to specific client
-IPs; an empty IP list means the differentiated limit does not apply. When
-exceeded, Postfix returns a 4xx and the refusal is recorded in Deliveries as
-`rejected`.
+**Level 2 — domain** — optional, on each domain's page. A message ceiling and
+window for **every** client IP sending as that domain. When unset, only
+level 1 applies for non-privileged senders.
+
+**Level 2 — application (trusted IPs)** — optional override on an application:
+list one or more client IPs and a ceiling **strictly above** the domain limit
+(still ≤ level 1). Connections from those IPs use the application ceiling and
+skip the domain check. Other IPs stay under the domain limit (or level 1 alone).
+An application override without trusted IPs is inactive.
+
+When a level-2 ceiling is exceeded, Postfix returns a 4xx and the refusal is
+recorded in Deliveries as `rejected`.
 
 ## Backup, restore, and moving a single domain