fix(panel): code-review P6 optional cleanup

Close the remaining low-risk items from the full-tree review: rename the settings handler, query assigned domains in SQL, bound the login limiter map, collapse panel.js show/hide helpers, and soften DMARC copy that promised a future in-panel receiver.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/auth/ratelimit.go

@@ -5,11 +5,14 @@ import (
 	"time"
 )
 
+const defaultMaxBuckets = 4096
+
 // rateLimiter is a simple fixed-window per-key counter used to throttle the
 // setup and login routes (security.md). Keys are client IPs.
 type rateLimiter struct {
-	max    int
-	window time.Duration
+	max        int
+	window     time.Duration
+	maxBuckets int
 
 	mu      sync.Mutex
 	buckets map[string]*rlBucket
@@ -22,12 +25,25 @@ type rlBucket struct {
 
 func newRateLimiter(max int, window time.Duration) *rateLimiter {
 	return &rateLimiter{
-		max:     max,
-		window:  window,
-		buckets: make(map[string]*rlBucket),
+		max:        max,
+		window:     window,
+		maxBuckets: defaultMaxBuckets,
+		buckets:    make(map[string]*rlBucket),
 	}
 }
 
+func (r *rateLimiter) startSweeper() {
+	go func() {
+		ticker := time.NewTicker(r.window)
+		defer ticker.Stop()
+		for range ticker.C {
+			r.mu.Lock()
+			r.sweep(time.Now())
+			r.mu.Unlock()
+		}
+	}()
+}
+
 func (r *rateLimiter) Allow(key string) bool {
 	now := time.Now()
 	r.mu.Lock()
@@ -35,6 +51,7 @@ func (r *rateLimiter) Allow(key string) bool {
 
 	b := r.buckets[key]
 	if b == nil || now.After(b.windowEnds) {
+		r.makeRoom(now)
 		r.buckets[key] = &rlBucket{count: 1, windowEnds: now.Add(r.window)}
 		r.sweep(now)
 		return true
@@ -46,6 +63,32 @@ func (r *rateLimiter) Allow(key string) bool {
 	return true
 }
 
+func (r *rateLimiter) makeRoom(now time.Time) {
+	if r.maxBuckets <= 0 || len(r.buckets) < r.maxBuckets {
+		return
+	}
+	r.sweep(now)
+	for len(r.buckets) >= r.maxBuckets {
+		r.evictOldest()
+	}
+}
+
+func (r *rateLimiter) evictOldest() {
+	var oldestKey string
+	var oldestEnds time.Time
+	first := true
+	for k, b := range r.buckets {
+		if first || b.windowEnds.Before(oldestEnds) {
+			oldestKey = k
+			oldestEnds = b.windowEnds
+			first = false
+		}
+	}
+	if oldestKey != "" {
+		delete(r.buckets, oldestKey)
+	}
+}
+
 func (r *rateLimiter) sweep(now time.Time) {
 	for k, b := range r.buckets {
 		if now.After(b.windowEnds) {