panel,mail: fail closed on the rate-limit race, session create and app delete

The level-2 limiter counted stored plus in-flight messages and reserved its own slot in two critical sections, so SMTP sessions that overlapped could each take the last free slot; tryAdmit now does both under one lock. A session that cannot be written no longer yields a cookie the browser would carry while every request bounced to /login. Deleting an application clears its SASL account before its registry row, matching domain delete, so a saslpasswd2 failure leaves a retryable application rather than an account that still authenticates.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -504,11 +504,15 @@ the list, the fragment, or query parameters. `go test ./...` green.
 
 **Model: Opus.**
 
-- [ ] `inflight.tryAdmit` (count + reserve under one lock). Extend milter
+- [x] `inflight.tryAdmit` (count + reserve under one lock). Extend milter
       tests with overlapping `MailFrom` (true concurrency, not sequential).
-- [ ] `sessionStore.Create` returns an error; login does not set a cookie on
+      Two tests: concurrent `MailFrom` sessions gated so they all read the
+      stored count before anyone reserves (exactly one admitted), and a
+      saturation test on `tryAdmit` that overshoots the ceiling whenever count
+      and reserve are separate critical sections.
+- [x] `sessionStore.Create` returns an error; login does not set a cookie on
       failure.
-- [ ] `app.Service.Delete`: SASL (and rate-limit row) before or compensating
+- [x] `app.Service.Delete`: SASL (and rate-limit row) before or compensating
       with the registry row; match domain-delete ordering. Test the failure
       path with a fake SASL that errors.