audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -724,9 +724,15 @@ a refresh cannot differ. HTMX refreshes them every 5 s while the operator is
 active on the page, every 30 s when the tab is visible but idle, and not at all
 when it is hidden — scheduled in `panel.js` via `data-poll`, not
 `hx-trigger="every …"`, because a trigger filter is evaluated with `new
-Function`, which the CSP forbids. Polling does not extend the session idle
-timeout (only non-`HX-Request` `GET`s and mutating requests count as
-activity). The Outbound queue's retry-policy box is outside the polled region:
+Function`, which the CSP forbids. The next refresh is scheduled when a
+request of the box ends, however it ended: a refresh that failed - an error
+answer, the panel restarting, the network gone - is tried again after twice
+the wait, doubling with each failure in a row up to a minute, and the wait
+is back to normal after one that works. A request without a session answers
+htmx with `HX-Redirect: /login` (status 401), and htmx loads the sign-in
+page in place of the whole page; a browser gets the 303 as before. Polling
+does not extend the session idle timeout (only non-`HX-Request` `GET`s and
+mutating requests count as activity). The Outbound queue's retry-policy box is outside the polled region:
 it is the start-up `postconf -h` snapshot (see [Panel
 binary](#panel-binary-cmdpanel)), not a live re-read.