panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates/user_form.html

@@ -21,9 +21,17 @@
     </select>
     {{if .LastGlobalLocked}}<p class="muted">The only global administrator cannot be demoted.</p>{{end}}
 
-    <fieldset id="domain-pick" data-domain-pick>
-      <legend>Assigned domains</legend>
-      <p class="muted">Required for domain administrators.</p>
+    {{/* Outbound and inbound domains are assigned separately; a domain
+         administrator needs at least one on either list. "All" also covers
+         domains added later — with it ticked the rows below are ignored. */}}
+    <div id="domain-pick" data-domain-pick>
+    <fieldset>
+      <legend>Outbound domains</legend>
+      <p class="muted">A domain administrator needs at least one outbound or inbound domain.</p>
+      <label class="check">
+        <input type="checkbox" name="all_domains" value="1" {{if .FormAllDomains}}checked{{end}}>
+        All, including domains added later
+      </label>
       {{range .Domains}}
       <label class="check">
         <input type="checkbox" name="domain_ids" value="{{.ID}}" {{if index $.FormDomains .ID}}checked{{end}}>
@@ -31,6 +39,22 @@
       </label>
       {{end}}
     </fieldset>
+    {{if .InboundEnabled}}
+    <fieldset>
+      <legend>Inbound domains</legend>
+      <label class="check">
+        <input type="checkbox" name="all_inbound_domains" value="1" {{if .FormAllInbound}}checked{{end}}>
+        All, including domains added later
+      </label>
+      {{range .InboundDomains}}
+      <label class="check">
+        <input type="checkbox" name="inbound_domain_ids" value="{{.ID}}" {{if index $.FormInbound .ID}}checked{{end}}>
+        {{.Name}}
+      </label>
+      {{end}}
+    </fieldset>
+    {{end}}
+    </div>
 
     <button type="submit">{{if .IsEdit}}Save{{else}}Create{{end}}</button>
   </form>