image: the TLS key's group is the panel's alone, 10997 (audit I1)

Security audit 2026-10-17, finding I1, stage 2; the help mockup is ff3a118.
The guide had operators give the TLS private key to group 10998 so the
panel can archive it, and the Dockerfile puts postfix in that group (for
sasldb2 and the maps): `docker exec -u postfix head privkey.pem` printed
the live key. postfix-config.sh copies the key to a root-only directory
precisely so that a compromised Postfix daemon cannot read it - the mounted
original undid that.

Now a group backupkey (gid 10997, outside the system range like 10998)
whose one member is the panel; the guide (Apache/certbot, nginx, Taking a
full backup, the backup table), Help, and the backup's refusal name 10997
and say why; postfix-config.sh, extract-cert.sh and the Dockerfile's
comments follow. A key still given to 10998 keeps working for the backup.
CHANGELOG has an Upgrading note.

e2e: the stage gives its key to 10997 at 0640 when the runner is root
(stageKeyMode; 0644 otherwise), and testFullBackupRestore, after the
refusal that now names chgrp 10997, checks that the postfix uid cannot read
/etc/postfix/tls/privkey.pem and the panel can.

Docs: security.md § Output and process (the groups); guide; CHANGELOG;
plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,8 +5,22 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Upgrading
+
+- **Give the TLS private key to group 10997** (audit I1): `chgrp 10997
+  certs/privkey.pem` - or certbot's `archive/<name>/privkey*.pem` - and the
+  same in whatever renews it. Group 10998, which the guide named until now,
+  has Postfix in it; the backup keeps working with either, but only 10997
+  keeps the key from Postfix's daemons.
+
 ### Security
 
+- **The TLS private key no longer has to be readable by Postfix** (audit
+  I1): the guide gave it to group 10998 for the panel's backup, and
+  `postfix` is in that group, so every Postfix daemon - an smtpd talking to
+  the internet included - could read it. A new group, `backupkey` (10997),
+  holds the panel alone; the guide, Help and the backup's refusal name it.
+
 - **A stolen `global` session no longer takes a full backup** (security
   audit 2026-10-17, A2, high): the user form set the signed-in user's own
   password without the current one, which then passed the backup's password