backup-reauth: the account password before a backup or an export

Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.

Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.

Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/static/panel.js

@@ -245,16 +245,34 @@
     });
   }
 
+  // A file field drawn as Bulma's .file (the import of a domain, mockup
+  // backup.html): the input lies transparent over "Choose a file…", and the
+  // name of the file chosen is written into .file-name, which says "No file
+  // chosen" until then. Without this script the field still works; only the
+  // name is not shown.
+  function syncFileName(input) {
+    var box = input.closest(".file");
+    var name = box && box.querySelector(".file-name");
+    if (name) {
+      name.textContent = input.files && input.files[0] ? input.files[0].name : "No file chosen";
+    }
+  }
+
   // One listener for the document rather than one per control: a form that
   // arrives in an htmx swap is covered without being wired up again.
   document.addEventListener("change", function (ev) {
     if (ev.target && ev.target.matches) {
       syncShowWhen(ev.target);
+      if (ev.target.matches("input.file-input")) {
+        syncFileName(ev.target);
+      }
     }
   });
 
+  // A page the browser restores from its history may keep the file chosen.
   document.addEventListener("DOMContentLoaded", function () {
     initShowWhen(document);
+    document.querySelectorAll("input.file-input").forEach(syncFileName);
   });
 
   // htmx:load fires for each top-level element htmx puts into the page, so