panel-notifications: the start puts the server's name into OpenDKIM's tables

Found on the test server after the rollout of b905f3e: the SigningTable had
the three sending domains and no line for selfpost.mixfed.ru. The tables are
rebuilt when a domain is added or deleted, and nothing had done either since
the upgrade - notifications would have gone out unsigned until something did.
The e2e stand did not show it: it adds a domain right after its start.

The notifier now asks at its start whether the table on disk has the line
and rebuilds the tables once if it does not (domain.Service.EnsureServerSigned).
A failure is logged and costs the signature, not the message.

Checked on Windows: go vet clean; go test ./internal/domain passes apart from
TestWriteLoadPrivateKeyRoundtrip, which fails there on file modes and always
did; the new test holds one rebuild, none the second time, and that a longer
name is not taken for the server's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/panel/notifier.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"log"
 
 	"github.com/mixeme/selfpost/internal/dnscheck"
 	"github.com/mixeme/selfpost/internal/health"
@@ -19,6 +20,15 @@ func runNotifier(ctx context.Context, cfg config, st *store.Store) error {
 	ms := newMailStack(cfg, st)
 	dns := dnscheck.New(cfg.dnsResolvers)
 
+	// OpenDKIM's tables are rebuilt when a domain is added or deleted. On the
+	// first start of a version that signs the server's own name they do not
+	// have its line yet. A failure here costs the signature, not the message.
+	if rebuilt, err := ms.Domains.EnsureServerSigned(); err != nil {
+		log.Printf("notifier: sign as %s: %v", cfg.hostname, err)
+	} else if rebuilt {
+		log.Printf("notifier: OpenDKIM now signs mail of %s", cfg.hostname)
+	}
+
 	n := notify.New(st, notify.Checks{
 		Domain: func(d store.Domain) (dnscheck.Domain, error) {
 			rec, err := ms.Domains.DKIMRecord(d)