Split internal/web into subpackages before domain-admin growth.

Lay out view, auth, validate, and handlers under internal/web while keeping
the cmd/panel API unchanged; update roadmap and changelog for web-split closure.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/validate/validate_email_test.go

@@ -0,0 +1,18 @@
+package validate
+
+import "testing"
+
+func TestValidateEmail(t *testing.T) {
+	if err := Email(""); err != nil {
+		t.Errorf("empty: %v", err)
+	}
+	if err := Email("reports@mail.example.com"); err != nil {
+		t.Errorf("valid: %v", err)
+	}
+	if err := Email("bad"); err == nil {
+		t.Error("bad address accepted")
+	}
+	if err := Email("x@gmail.com"); err == nil {
+		t.Error("gmail accepted")
+	}
+}