backup-reauth: the account password before a backup or an export

Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.

Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.

Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -428,6 +428,18 @@ operator can act on it.
 
 ### Backup and domain export
 
+- **A session is not enough to take them** (backup-reauth, owner
+  2026-10-13; built 2026-10-16). The full backup and a domain's export ask
+  for the signed-in user's own account password at every download, checked
+  with bcrypt as a password change checks it and under the same limiter -
+  ten checks in fifteen minutes per user, shared with the Account form -
+  so a stolen session cookie or a panel left open no longer hands over a
+  copy of the server, and the field is no place to guess a password from.
+  A wrong one is refused with 401 and logged; nothing is sent
+  (`internal/web/handlers`, `reauth`). *Encrypt with a password* is the
+  file's own protection, not this one: whoever downloads it chooses that
+  password. The import and the `selfpost-backup` CLI, which runs inside the
+  container, are not asked.
 - Both files are secrets: a full backup carries DKIM keys, `sasldb2`, the
   panel users' password hashes, `docker-compose.yml`, `.env`, and the TLS
   private key from `certs/` when present; a domain export carries the DKIM key