findings of the security review of stage 1

The review of d254a99..fd29468 (read-only, a separate agent) found all
five fixes sound and nothing above low. Fixed here:

- The M1 e2e step passed on the unfixed code: the stranger's RSET between
  MAIL FROMs ends the transaction, Postfix's mail_reset() calls
  milter_abort(), and the old code released the slot too. The stranger now
  keeps one MAIL FROM open (strangerHoldsMailFrom) while the domain's own
  application sends; under the old code that slot was the domain's one.
- A domain import could still store a report address on the server's own
  name (W1's form rule only): checkDomainImport refuses one that is not
  the domain's own hosted address. Not a mailbox either way, but the
  panel would show an address the server refuses. Cases in
  TestDomainImportIsCheckedLikeTheForms.
- DeleteDomain matches the reports' domain without regard to case.
- A cut that fails after the journal rows were written says the rows were
  written.
- dmarc.Service.Resync and inbound.Service.Resync are serialised like
  app.Service.Resync (W3's shape, outside its diff).

Left as the review's nit: three ApplicationByLogin lookups for a refused
MAIL FROM (a refusal is rare; the store is local).

go test ./internal/dmarc ./internal/inbound ./internal/store; the import
test; GOOS=linux go vet ./test/e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/domains.go

@@ -144,7 +144,7 @@ func (s *Store) DeleteDomain(id int64) error {
 		return fmt.Errorf("delete domain: begin: %w", err)
 	}
 	defer tx.Rollback() //nolint:errcheck // a no-op after Commit
-	if _, err := tx.Exec(`DELETE FROM dmarc_reports WHERE domain = (SELECT name FROM domains WHERE id = ?)`, id); err != nil {
+	if _, err := tx.Exec(`DELETE FROM dmarc_reports WHERE domain = (SELECT name FROM domains WHERE id = ?) COLLATE NOCASE`, id); err != nil {
 		return fmt.Errorf("delete domain: its DMARC reports: %w", err)
 	}
 	res, err := tx.Exec("DELETE FROM domains WHERE id = ?", id)

internal/store/inboundspam.go

@@ -91,7 +91,7 @@ func (s *Store) countInboundWrites(n int) error {
 	s.inboundWrites.Store(0)
 	// The zero time removes nothing by age: this is the cap alone.
 	if _, err := s.PruneInboundSpam(time.Time{}, inboundCapRows); err != nil {
-		return fmt.Errorf("cut inbound_spam_log to %d rows: %w", inboundCapRows, err)
+		return fmt.Errorf("the rows were written; cutting inbound_spam_log to %d rows: %w", inboundCapRows, err)
 	}
 	return nil
 }