panel,mail: fail closed on the rate-limit race, session create and app delete

The level-2 limiter counted stored plus in-flight messages and reserved its own slot in two critical sections, so SMTP sessions that overlapped could each take the last free slot; tryAdmit now does both under one lock. A session that cannot be written no longer yields a cookie the browser would carry while every request bounced to /login. Deleting an application clears its SASL account before its registry row, matching domain delete, so a saslpasswd2 failure leaves a retryable application rather than an account that still authenticates.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/auth/handlers.go

@@ -120,7 +120,12 @@ func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	token := m.sessions.Create(user.Username)
+	token, err := m.sessions.Create(user.Username)
+	if err != nil {
+		logf("panel: login: create session failed: %v", err)
+		m.renderLogin(w, http.StatusInternalServerError, "Internal error. Please try again.")
+		return
+	}
 	m.setSessionCookie(w, token)
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }