dmarc-day, health-sockets: the reporter's day said; the inbound journal dialled

The owner, 2026-10-17: "Показ времени отчёта по UTC принимаем. Это не
проблема. Пояснения добавь. Все мелочи закрой." Designs 9b33b80, 2bf9056.

DMARC: a report's day stays the reporter's, in UTC (RFC 7489 § 7.2); the
report's Window now says so under its times (windowNote), and Settings'
Time zone box and Help (#settings, #dmarc) name it as the one exception to
the panel's zone. formatDMARCWindow counts a window that ends at midnight
as ending the day before, so a daily report is one day, not "20 Sep - 21
Sep" (TestDMARCWindowIsTheReportersDay, in Moscow's zone).

Health: with the inbound relay on, the inbound journal milter's socket is
dialled (InboundJournalSocket through web and handlers Config), fail-open
as the send log's, and Overview's card counts it; the send log's socket is
named journal-milter, as the mockup names it.

The confirmation link's sign-in state is drawn (confirm-email-signin.html);
the panel already renders it.

guide: /license and /server/components, the DMARC pages' paths and day,
selfpost-backup -o / -i / -version, the Inbound log's retention field,
PANEL_COOKIE_SECURE, the inbound journal's socket, the DMARC exception to
the zone. CHANGELOG [Unreleased].

(The e2e case negative_level1_ratelimit, listed as able to pass falsely,
was fixed on 2026-10-14 - the note was stale.)

go vet + go test (26 packages) and make e2e on the test server for this
tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/web.go

@@ -81,6 +81,9 @@ type Config struct {
 	SignSocket      string
 	SignLocalSocket string
 	JournalSocket   string
+	// InboundJournalSocket is the inbound journal milter's, dialled with
+	// the inbound relay on; it fails open like the journal's.
+	InboundJournalSocket string
 	// SenderSocket is the sender check's socket, attached strictly.
 	SenderSocket string
 	// SessionIdleDays is the sliding inactivity window after which a login
@@ -160,6 +163,7 @@ func New(st *store.Store, domains *domain.Service, apps *app.Service, inboundSvc
 		SignSocket:                 cfg.SignSocket,
 		SignLocalSocket:            cfg.SignLocalSocket,
 		JournalSocket:              cfg.JournalSocket,
+		InboundJournalSocket:       cfg.InboundJournalSocket,
 		SenderSocket:               cfg.SenderSocket,
 		RateLimitMessagesPerIP:     cfg.RateLimitMessagesPerIP,
 		RateLimitWindowSeconds:     cfg.RateLimitWindowSeconds,