fix(panel): code-review P6 optional cleanup

Close the remaining low-risk items from the full-tree review: rename the settings handler, query assigned domains in SQL, bound the login limiter map, collapse panel.js show/hide helpers, and soften DMARC copy that promised a future in-panel receiver.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/handlers/authz_test.go

@@ -57,7 +57,7 @@ var globalOnlyRoutes = []route{
 // case the send-log leak (P0, code-review.md) showed is easy to get wrong.
 func TestGlobalOnlyRoutesAnswerADomainAdmin404(t *testing.T) {
 	h, domains := serverWithTwoDomains(t)
-	p := domainAdmin(domains["first.example.ru"].ID)
+	p := domainAdmin(t, h.store, "global-only", domains["first.example.ru"].ID)
 
 	for _, rt := range globalOnlyRoutes {
 		rec := call(h, rt, p)