fix: port-25 milter chain, DMARC report validation, auto rate-limit window

Review pass over the 1.4.0-1.9.1 work.

Port 25 no longer inherits main.cf's submission milter chain: smtpd_milters
is always overridden on smtp/inet, to the antispam milter or to nothing.
Without that, OpenDKIM (strict, tempfail) gated relayed mail during a signing
outage, and the journal-milter filed inbound mail into the outbound send log
under the sender's domain -- so Deliveries showed other people's mail and a
forged From: consumed that domain's level-2 budget. architecture.md already
described the intended behaviour; the code now matches.

DMARC reports are checked before they are stored: the policy domain must be a
configured sending domain, and must match the +tag of a per-domain hosted
address. The rua address form is predictable, so anyone able to reach it could
file reports under any domain and evict genuine ones through the retention cap.
Zip attachments are now decompressed as well as gzip.

The auto level-2 ceiling is scaled to the level-1 window before the multiplier
is applied; any window other than 3600s shifted the allowance by window/3600.

Migration 0010 indexes send_log(app_login, created_at) -- both the per-MAIL
FROM rate-limit count and the per-application statistics were scanning the
created_at range.

e2e now regenerates the Postfix config in-container for all four port-25 flag
combinations and requires postfix check to pass; the 1.9.1 crash-loop shipped
in 1.4.0 and survived three releases because only the flags-off path was
exercised.

Migration 0009 stays as shipped -- its conversion branch only fires for a
database carrying application-scope allowed_ips from before 1.9.0. The schema
reference notes that the old list was permissive and the new column is
restrictive; the guide documents the allow-list as a sending control on a
fail-open path, not an authentication boundary.

Also: gofmt across cmd/ and internal/, unused duplicate validators dropped from
internal/web/validate, export no longer swallows store errors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/domain/transfer.go

@@ -19,14 +19,14 @@ const FormatDomainExport = "selfpost-domain-export"
 // transfer without regeneration). The file is therefore as sensitive as a full
 // backup and must be handled as a secret.
 type DomainExport struct {
-	Format         string      `json:"format"`
-	Version        string      `json:"version"`
-	Domain         string      `json:"domain"`
-	DKIMSelector   string      `json:"dkim_selector"`
-	DKIMPrivateKey string      `json:"dkim_private_key"`    // PKCS#1 PEM
-	DMARCRua       *string     `json:"dmarc_rua,omitempty"` // nil = inherit profile; set = override ("" = none)
+	Format         string           `json:"format"`
+	Version        string           `json:"version"`
+	Domain         string           `json:"domain"`
+	DKIMSelector   string           `json:"dkim_selector"`
+	DKIMPrivateKey string           `json:"dkim_private_key"`    // PKCS#1 PEM
+	DMARCRua       *string          `json:"dmarc_rua,omitempty"` // nil = inherit profile; set = override ("" = none)
 	RateLimit      *RateLimitExport `json:"rate_limit,omitempty"`
-	Applications   []AppExport `json:"applications"`
+	Applications   []AppExport      `json:"applications"`
 }
 
 // RateLimitExport is the transferable level-2 limit for a domain or application.
@@ -40,13 +40,13 @@ type RateLimitExport struct {
 
 // AppExport is one application within a DomainExport.
 type AppExport struct {
-	Login            string   `json:"login"`
-	AddressMode      string   `json:"address_mode"`
-	Addresses        []string `json:"addresses,omitempty"` // list mode only
-	Password         string   `json:"password"`
-	AuthIPRestrict   bool     `json:"auth_ip_restrict,omitempty"`
-	AuthAllowedIPs   []string `json:"auth_allowed_ips,omitempty"`
-	RateLimit        *RateLimitExport `json:"rate_limit,omitempty"`
+	Login          string           `json:"login"`
+	AddressMode    string           `json:"address_mode"`
+	Addresses      []string         `json:"addresses,omitempty"` // list mode only
+	Password       string           `json:"password"`
+	AuthIPRestrict bool             `json:"auth_ip_restrict,omitempty"`
+	AuthAllowedIPs []string         `json:"auth_allowed_ips,omitempty"`
+	RateLimit      *RateLimitExport `json:"rate_limit,omitempty"`
 }
 
 // Export builds the transferable representation of a domain: its DKIM key, its
@@ -78,7 +78,11 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 		s := d.DMARCRua.String
 		exp.DMARCRua = &s
 	}
-	if rl, ok, err := s.store.GetRateLimit(store.RateLimitScopeDomain, id); err == nil && ok {
+	rl, ok, err := s.store.GetRateLimit(store.RateLimitScopeDomain, id)
+	if err != nil {
+		return DomainExport{}, fmt.Errorf("export rate limit for %s: %w", d.Name, err)
+	}
+	if ok {
 		exp.RateLimit = exportRateLimit(rl)
 	}
 	for _, a := range apps {
@@ -94,8 +98,12 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 			AuthIPRestrict: a.AuthIPRestrict,
 			AuthAllowedIPs: a.AuthAllowedIPs,
 		}
-		if rl, ok, err := s.store.GetRateLimit(store.RateLimitScopeApp, a.ID); err == nil && ok {
-			appExp.RateLimit = exportRateLimit(rl)
+		appRL, ok, err := s.store.GetRateLimit(store.RateLimitScopeApp, a.ID)
+		if err != nil {
+			return DomainExport{}, fmt.Errorf("export rate limit for %s: %w", a.Login, err)
+		}
+		if ok {
+			appExp.RateLimit = exportRateLimit(appRL)
 		}
 		exp.Applications = append(exp.Applications, appExp)
 	}