Phase 2: SQLite persistence, admin setup-link, login/sessions

Implements the secure single-admin panel entry (spec 7.6).

- internal/store: modernc.org/sqlite (pure Go, static build), WAL +
  foreign keys, embedded PRAGMA user_version migrations; schema 0001
  covers admin/settings/domains/applications/send_log/rate_limits (spec 9).
- Setup secret-link (spec 7.6.1): 128-bit crypto/rand token, printed to
  log + /data/setup-token (0600), 10-min TTL with regeneration, per-IP
  rate limit, subtle.ConstantTimeCompare, failures don't invalidate,
  one-time admin form, permanent invalidation once admin exists (/setup 404).
- bcrypt admin password; server-side username/password validation.
- Login + in-memory sessions, crypto-random token, cookie
  HttpOnly/Secure/SameSite (Secure toggleable for dev HTTP), login
  rate limit, auth middleware.
- html/template base layout + setup/login/dashboard, vendored htmx 2.0.4.
- build/entrypoint.sh: fix bind-mounted /data ownership as root before
  supervisord drops to the unprivileged panel user (found via container test).

Verified on selfpost.mixfed.ru: go vet/build/test/gofmt clean; e2e curl
of setup+login flows; docker build + run with -v ./data:/data creates the
DB and 0600 token owned by panel.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

build/Dockerfile

@@ -13,9 +13,9 @@ WORKDIR /src
 # Version stamped into both binaries; MUST match the image tag (spec 7.5.A).
 ARG VERSION=dev
 
-# Module metadata first for layer caching. No go.sum yet — Phase 1 has no
-# third-party dependencies.
-COPY go.mod ./
+# Module metadata first for layer caching. go.sum arrived in Phase 2 with the
+# SQLite driver and bcrypt.
+COPY go.mod go.sum ./
 RUN go mod download
 
 COPY cmd ./cmd
@@ -69,11 +69,13 @@ COPY --from=build /out/selfpost-backup /usr/local/bin/selfpost-backup
 COPY build/opendkim.conf /etc/opendkim.conf
 COPY build/postfix-wrapper.sh /usr/local/bin/postfix-wrapper.sh
 COPY build/crashexit.py /usr/local/bin/crashexit.py
+COPY build/entrypoint.sh /usr/local/bin/entrypoint.sh
 COPY build/supervisord.conf /etc/supervisor/supervisord.conf
-RUN chmod +x /usr/local/bin/postfix-wrapper.sh /usr/local/bin/crashexit.py
+RUN chmod +x /usr/local/bin/postfix-wrapper.sh /usr/local/bin/crashexit.py /usr/local/bin/entrypoint.sh
 
 # 8080 panel; 25 outbound; 465/587 inbound submission (used from Phase 5).
 EXPOSE 8080 25 465 587
 
-# supervisord is PID 1 and owns process supervision + ordering (spec 4).
-CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]
+# The entrypoint fixes /data ownership (bind mount) as root, then execs
+# supervisord, which becomes PID 1 and owns process supervision (spec 4).
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

build/entrypoint.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Container entrypoint (runs as root, PID 1 until it execs supervisord).
+#
+# The persistent root /data is a host bind mount (spec 9), so it arrives owned
+# by the host user (typically root), not by the unprivileged panel user that
+# actually writes the SQLite database, setup token and DKIM keys (spec 7.6.8).
+# Fix its ownership here — the one place still running as root — before handing
+# off to supervisord, which starts the panel as the panel user.
+set -e
+
+chown panel:panel /data
+# Restored backups or previously-created state may contain panel-owned files
+# under /data; make sure they stay writable without disturbing anything that a
+# later phase deliberately hands to another service.
+find /data -mindepth 1 -maxdepth 1 ! -user panel -exec chown -R panel:panel {} +
+
+exec /usr/bin/supervisord -c /etc/supervisor/supervisord.conf