panel-notifications: the start puts the server's name into OpenDKIM's tables

Found on the test server after the rollout of b905f3e: the SigningTable had
the three sending domains and no line for selfpost.mixfed.ru. The tables are
rebuilt when a domain is added or deleted, and nothing had done either since
the upgrade - notifications would have gone out unsigned until something did.
The e2e stand did not show it: it adds a domain right after its start.

The notifier now asks at its start whether the table on disk has the line
and rebuilds the tables once if it does not (domain.Service.EnsureServerSigned).
A failure is logged and costs the signature, not the message.

Checked on Windows: go vet clean; go test ./internal/domain passes apart from
TestWriteLoadPrivateKeyRoundtrip, which fails there on file modes and always
did; the new test holds one rebuild, none the second time, and that a longer
name is not taken for the server's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/service.go

@@ -83,6 +83,25 @@ func (s *Service) ServerMail() (ServerMail, error) {
 	return ServerMail{Name: s.serverName, Selector: selector, Record: rec}, nil
 }
 
+// EnsureServerSigned makes sure OpenDKIM's tables have the line for the
+// server's own name, rebuilding them if they do not. The tables are otherwise
+// rebuilt only when a domain is added or deleted, so an installation that was
+// upgraded to a version with notifications would go on sending them unsigned
+// until then. It reports whether it had to rebuild.
+func (s *Service) EnsureServerSigned() (bool, error) {
+	if s.serverName == "" {
+		return false, nil
+	}
+	signed, err := s.odk.signs(s.serverName)
+	if err != nil {
+		return false, err
+	}
+	if signed {
+		return false, nil
+	}
+	return true, s.resync()
+}
+
 // serverSelector is the selector the server's own name is signed with: that of
 // the sending domain of the same name if there is one, the default otherwise.
 func (s *Service) serverSelector() (string, error) {