Phase 8: level-2 differentiated rate limits (spec 7.4)

The journal-milter, until now a pure monitor, now refuses a message with a
4xx tempfail (RespTempFail/451) at MAIL FROM when a per-domain or per-
application limit is exceeded. Key is the client IP; the count is
COUNT(DISTINCT queue_id) over a sliding window reusing the send log; the
limit applies only when a non-empty IP binding matches the client (empty
binding => level-1 only, per spec 7.4). Enforcement is fail-open on the
milter's own errors — a limiter malfunction never blocks mail, and Postfix's
level-1 anvil limit stays the independent backstop. Refused messages are
recorded in send_log with status "rejected" for UI visibility.

- store/ratelimits.go: RateLimit type (+Active/AllowsIP), id-keyed get/set/
  delete for the panel, name/login-keyed lookup + windowed distinct-message
  count for the milter, DeleteRateLimitsForDomain. No migration — the
  rate_limits table has existed since Phase 2.
- milter: enforce at MailFrom, fail-open helper overLimit, InsertRejected.
- web: server-side validated IP/ceiling/window forms on the domain page and
  per application; routes POST /domains/{id}/ratelimit and
  /applications/{aid}/ratelimit. Milter reads rows live, so no reload.
- domain/app services clear limits on deletion (rate_limits has no FK cascade).

Unit tests + container e2e (p8) green: refusal on both scopes, unregistered
IP ignored, fail-open with the panel stopped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/store/sendlog.go

@@ -14,6 +14,10 @@ const (
 	StatusSent     = "sent"
 	StatusDeferred = "deferred"
 	StatusBounced  = "bounced"
+	// StatusRejected marks a message the journal-milter refused with a 4xx under
+	// a level-2 rate limit (spec 7.4). Such a row never gets a queue-id and is
+	// excluded from the level-2 message count (it was never sent).
+	StatusRejected = "rejected"
 )
 
 // SendLogEntry is a single queued send-log row. The journal-milter creates one
@@ -46,6 +50,24 @@ func (s *Store) InsertQueued(e SendLogEntry) error {
 	return nil
 }
 
+// InsertRejected records a message the journal-milter refused under a level-2
+// rate limit (spec 7.4), so the rejection is visible in the send-log UI. Only
+// the fields known at MAIL FROM are set (domain, sender, app login); there is no
+// queue-id or recipient because the message was rejected before it was queued.
+func (s *Store) InsertRejected(e SendLogEntry) error {
+	now := time.Now().UTC().Format(time.RFC3339)
+	_, err := s.db.Exec(
+		`INSERT INTO send_log
+			(queue_id, domain, app_login, from_addr, to_addr, subject, status, created_at, updated_at)
+		 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		e.QueueID, e.Domain, e.AppLogin, e.From, e.To, e.Subject, StatusRejected, now, now,
+	)
+	if err != nil {
+		return fmt.Errorf("insert rejected send_log: %w", err)
+	}
+	return nil
+}
+
 // UpdateStatus advances the delivery status of the send-log rows matching a
 // (queue-id, recipient) pair, which the log-tailer parses out of mail.log.
 // Recipient matching is case-insensitive because Postfix may normalise address