docs: rewrite security/operator docs for the multi-user panel (P2)

The CSRF ADR, guide.md, architecture.md route table, the internal/backup
package comment, roadmap/dmarc-reports admin.dmarc_report_email references,
the e2e coverage summary, and the setupManager/store package comments still
described the pre-1.2.0 single-administrator panel or stale implementation
details. Closes P2 of docs/plans/code-review.md; no behaviour change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/roadmap.md

@@ -118,9 +118,10 @@ reports (`ruf=`) out of scope for v1.
 
 **Dependencies / risks:** inbound SMTP in the image (may share infrastructure
 with [inbound-relay](plans/inbound-relay.md) but must not require backup-MX);
-storage and retention of parsed summaries; the `admin.dmarc_report_email` and
-`domains.dmarc_rua` settings added in the DMARC template work must stay the
-source of truth for `rua=` in DNS guidance.
+storage and retention of parsed summaries; the `dmarc_report_email` setting
+(migration `0005` moved it off the old `admin` table into `settings`) and
+`domains.dmarc_rua` added in the DMARC template work must stay the source of
+truth for `rua=` in DNS guidance.
 
 **Order:** after the DMARC `rua=` settings ship; may follow or overlap with
 inbound-relay depending on how port 25 acceptance is structured.