image: the TLS key's group is the panel's alone, 10997 (audit I1)

Security audit 2026-10-17, finding I1, stage 2; the help mockup is ff3a118.
The guide had operators give the TLS private key to group 10998 so the
panel can archive it, and the Dockerfile puts postfix in that group (for
sasldb2 and the maps): `docker exec -u postfix head privkey.pem` printed
the live key. postfix-config.sh copies the key to a root-only directory
precisely so that a compromised Postfix daemon cannot read it - the mounted
original undid that.

Now a group backupkey (gid 10997, outside the system range like 10998)
whose one member is the panel; the guide (Apache/certbot, nginx, Taking a
full backup, the backup table), Help, and the backup's refusal name 10997
and say why; postfix-config.sh, extract-cert.sh and the Dockerfile's
comments follow. A key still given to 10998 keeps working for the backup.
CHANGELOG has an Upgrading note.

e2e: the stage gives its key to 10997 at 0640 when the runner is root
(stageKeyMode; 0644 otherwise), and testFullBackupRestore, after the
refusal that now names chgrp 10997, checks that the postfix uid cannot read
/etc/postfix/tls/privkey.pem and the panel can.

Docs: security.md § Output and process (the groups); guide; CHANGELOG;
plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -266,6 +266,12 @@ operator can act on it.
   `mail.log`, which `postfix` writes, through it the other way
   ([build/Dockerfile](../build/Dockerfile), `build/entrypoint.sh`). The DKIM
   keys are not in it (§ Mail path).
+- **Group `backupkey` (gid 10997) has one member, `panel`.** The operator
+  gives the host's TLS private key to it so that a full backup carries the
+  key; Postfix serves a root-only copy and has no way to the original. Until
+  `2.14.4` the guide gave the key to `selfpost`, so every Postfix daemon -
+  an smtpd talking to the internet included - could read it (security audit
+  2026-10-17, I1; measured on the test server with `docker exec -u postfix`).
 - **The container keeps `KILL`** (`deploy/docker-compose.yml`, `cap_add`;
   every other capability not listed there is dropped). Without it root
   cannot signal a process of another uid (kill(2), capabilities(7); measured