docs, comments: the drift the audit listed (audit 2026-10-17, stage 6)

The lines under "Doc and comment drift" that the findings' own commits
did not already fix:
- security.md: a newer confirmation link replaces the older, a reset link
  is not replaced; html/template renders every page (no themes); the
  container keeps eight capabilities, named, not "KILL".
- architecture.md: ImportKey writes over a name's key, as an import must;
  the error text reaches the browser on the Backup page's import refusal.
- guide: with Caddy the key is in Caddy's data, so a full backup refuses
  until certs/ holds a copy (or back up caddy-data).
- comments: sasldb2 holds application passwords in the clear (store,
  app/password.go); texthash folds ASCII (sender.go); the supervisor
  socket's group is supervisor (rpc.go); cert-reload's OpenSSL measurement
  was 3.0.x of bookworm; sendReset's limits (links.go).
Migration 0013's comment stays as shipped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -243,7 +243,9 @@ then OpenDKIM did, in a program of its own
   (`internal/domain`, `Keys`; `DKIM_DIR`, default `/data/dkim`). A key is
   made when a domain is added and an existing one is reused, never
   overwritten: that would invalidate the record already published
-  (`EnsureKey`). A domain export carries the key and an import writes it. A
+  (`EnsureKey`). A domain export carries the key and an import writes it,
+  over whatever key the name had (`ImportKey`: the import is the domain
+  with exactly that key). A
   deleted domain's key directory is removed once the selector table no
   longer names it; one a deletion had to leave, Reload configuration removes
   (`Service.Resync`).
@@ -1031,7 +1033,8 @@ A validation refusal is shown as the text the validator wrote (on the form,
 next to the field, or in a notice above the first box). Anything else — a
 database error, `saslpasswd2`, a Postfix reload — is logged
 and the page gets a fixed sentence saying so; the error text never reaches the
-browser. A template error renders a bare `500` rather than a half-written page
+browser - save on the global-only Backup page, where an import's refusal
+names what is wrong with the file (security.md § Output and process). A template error renders a bare `500` rather than a half-written page
 (`Engine.Render` buffers).
 
 ### Sessions