phase4-6: harden help/docs links and auth defaults

Close remaining low-priority review follow-ups by removing hardcoded help URLs, improving help drawer accessibility, raising explicit bcrypt cost, and adding validation/injection coverage; also bound postqueue reads with a timeout to avoid hangs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/postfix/dmarc_test.go

@@ -33,3 +33,21 @@ func TestRenderDMARCMapsEmpty(t *testing.T) {
 		t.Fatalf("expected empty maps")
 	}
 }
+
+func TestRenderDMARCMapsRejectsInjectionTokens(t *testing.T) {
+	_, _, _, err := renderDMARCMaps(DMARCMapsConfig{
+		Recipients: []string{"dmarc@example.com\nattacker@example.com"},
+		Domains:    []string{"example.com"},
+	})
+	if err == nil {
+		t.Fatal("expected recipient token validation error")
+	}
+
+	_, _, _, err = renderDMARCMaps(DMARCMapsConfig{
+		Recipients: []string{"dmarc@example.com"},
+		Domains:    []string{"example.com attacker"},
+	})
+	if err == nil {
+		t.Fatal("expected domain token validation error")
+	}
+}