fix(panel): code-review P6 optional cleanup

Close the remaining low-risk items from the full-tree review: rename the settings handler, query assigned domains in SQL, bound the login limiter map, collapse panel.js show/hide helpers, and soften DMARC copy that promised a future in-panel receiver.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/auth/middleware.go

@@ -44,15 +44,3 @@ func CurrentUser(r *http.Request) string {
 	}
 	return ""
 }
-
-// RequireGlobal wraps a handler that only global administrators may reach.
-func RequireGlobal(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		p, ok := CurrentPrincipal(r.Context())
-		if !ok || !p.IsGlobal() {
-			http.NotFound(w, r)
-			return
-		}
-		next.ServeHTTP(w, r)
-	})
-}