panel-redesign: inbound is delegated per user, separately from outbound

Stage 1, step 2 (plan § Who sees what).

Store
  - Reach{AllDomains, DomainIDs, AllInbound, InboundDomainIDs} is what a
    domain user is assigned. CreateUser takes it; SetUserReach / ClearUserReach
    replace SetUserDomains / ClearUserDomains and write both directions in one
    transaction. A domain user with nothing on either list is refused
    (ErrEmptyReach). With All set the rows of that direction are not stored,
    so clearing All later brings nothing stale back.
  - ListDomainsForUser honours all_domains; ListInboundDomainsForUser is its
    inbound twin. Both filter in the query.

Authorization
  - auth.Principal carries the whole reach: CanAccessDomain (now also true
    with All), CanAccessInboundDomain, HasOutbound, HasInbound. An id or a
    name on one list opens nothing on the other.
  - Inbound handlers in three strengths: requireInbound (the list, filtered),
    requireInboundDomain (one domain: page, DNS re-check, upstream,
    recipients), requireInboundGlobal (add, delete confirm, delete). All
    answer the same 404.
  - domainIDSet and the DMARC report pages go through the principal instead
    of looking at p.Domains themselves.

Panel (old templates, until stage 2)
  - User form: two lists with All; inbound is offered only where the feature
    is on, and saving the form with it off keeps the user's inbound reach.
    Promotion to global drops the reach.
  - Menu: a group with nothing assigned is absent; / sends an inbound-only
    administrator to Inbound. The inbound pages hide add / delete from a
    domain administrator.

Tests: every route of one inbound domain against five kinds of refused
request (another tenant's id, a missing id, outbound-only reach, an outbound
domain with the same id, one with the same name, no principal) with the 404
bodies compared; add/delete as every non-global user; the filtered list
including a domain added later; thirteen outbound routes against another
tenant's domain and application id; the user form; the reach in the store;
the principal matrix; the menu; the home redirect. Removing the access check
or the query filter makes the tests fail (checked by hand).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail that predate this work.

Roadmap 12/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates_test.go

@@ -687,3 +687,46 @@ func TestNavIncludesHelp(t *testing.T) {
 		t.Error("nav is missing Help link")
 	}
 }
+
+// A group with nothing assigned is absent from that user's menu: a domain
+// administrator who was given inbound domains only sees Inbound and none of the
+// sending pages, and the mark takes them to what they have.
+func TestLegacyNavFollowsTheUsersReach(t *testing.T) {
+	engine, err := New("test")
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	nav := func(data map[string]any) string {
+		t.Helper()
+		data["User"], data["Active"] = "ops", ""
+		data["InboundEnabled"], data["DMARCEnabled"] = true, true
+		var buf bytes.Buffer
+		if err := engine.Page("help").ExecuteTemplate(&buf, "nav", data); err != nil {
+			t.Fatalf("execute nav: %v", err)
+		}
+		return buf.String()
+	}
+	has := func(out, href string) bool { return strings.Contains(out, `href="`+href+`"`) }
+
+	out := nav(map[string]any{"HasInbound": true})
+	if !has(out, "/inbound") {
+		t.Errorf("an inbound-only administrator has no Inbound entry:\n%s", out)
+	}
+	for _, gone := range []string{"/domains", "/deliveries", "/dmarc", "/status", "/users", "/mail-queue"} {
+		if has(out, gone) {
+			t.Errorf("an inbound-only administrator is offered %s", gone)
+		}
+	}
+
+	out = nav(map[string]any{"HasOutbound": true})
+	if has(out, "/inbound") || !has(out, "/domains") || !has(out, "/deliveries") || !has(out, "/dmarc") {
+		t.Errorf("an outbound-only administrator's menu is wrong:\n%s", out)
+	}
+
+	out = nav(map[string]any{"IsGlobal": true})
+	for _, want := range []string{"/status", "/domains", "/inbound", "/dmarc", "/deliveries", "/users"} {
+		if !has(out, want) {
+			t.Errorf("the global role lost %s", want)
+		}
+	}
+}