backup-reauth: the account password before a backup or an export

Agreed with the owner on 2026-10-13, taken up on 2026-10-16 ("Да"); the
mockup is 1888dce. Both secret downloads - the full backup on Server ›
Backup and a domain's export on its settings - ask for "Your account
password": reauth (handlers_backup.go) checks the signed-in user's own
password with bcrypt, as a password change does, under the same limiter
(auth.AllowPasswordChange: ten in fifteen minutes per user, shared with the
Account form). A wrong or missing one is 401 on the same page with "Your
account password is incorrect.", logged; nothing is sent. The import and
the selfpost-backup CLI are not asked.

Also, the owner's phone screenshot of 2026-10-16 ("кнопка выбора файла не
такая, как в макете. Это косяк?"): the import's file field was a bare
<input type="file"> drawn by the browser ("Browse…"), where the mockup has
Bulma's .file - "Choose a file…" and the name chosen. The template now
follows the mockup; panel.js writes the name into .file-name on change and
at load (testdata/filename_test.js, run by TestPanelJS). No other file
field exists.

Tests: TestSecretDownloadsAskForTheAccountPassword (missing, wrong, right,
the limiter), the export refusals of the settings page with the password,
cmd/panel's restore tests and e2e's backups with it, e2e's refusal of a
backup without and with a wrong password. go vet + go test (26 packages)
and make e2e on the test server for this tree.

Docs: security.md § Backup and domain export, guide § Full backup and
restore, help (word for word with the mockup); CHANGELOG [Unreleased];
roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates/backup.html

@@ -23,6 +23,8 @@
     </div>
     <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
   </div>
+  <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+    <p class="help">The one you sign in with, asked at every download: the archive holds every secret of the server, and a session left open must not be enough to take it.</p></div>
   <button type="submit" class="button is-primary"><i class="ti ti-download"></i>Download full backup</button>
 </form>
 {{template "body_close"}}
@@ -35,7 +37,7 @@
 <p class="mb-3">A domain export from another instance — plain <code>.json</code> or encrypted <code>.spde</code>. Its DKIM key and application passwords come across, so the published DNS needs no change. The export itself is made on the domain's settings page.</p>
 <form class="sp-form" method="post" action="{{.ImportAction}}" enctype="multipart/form-data">
   <div class="field"><label class="label" for="importfile">Domain export file</label>
-    <div class="control"><input class="input" id="importfile" name="file" type="file" accept=".json,.spde,application/json" required data-import-file></div></div>
+    <div class="file has-name is-fullwidth"><label class="file-label"><input class="file-input" id="importfile" name="file" type="file" accept=".json,.spde,application/json" required data-import-file><span class="file-cta"><i class="ti ti-upload"></i><span class="file-label ml-2">Choose a file…</span></span><span class="file-name">No file chosen</span></label></div></div>
   <div class="field" data-import-password-fields><label class="label" for="importpw">Password</label>
     <div class="control"><input class="input" id="importpw" name="import_password" type="password" autocomplete="off"></div>
     <p class="help">Asked only for an encrypted <code>.spde</code> file.</p></div>

internal/web/view/templates/out_domain_settings.html

@@ -36,6 +36,8 @@
     </div>
     <p class="help mb-3">Keep this password: SelfPost does not store it, and the file cannot be opened without it.</p>
   </div>
+  <div class="field"><label class="label" for="acpw">Your account password</label><div class="control"><input class="input" id="acpw" name="account_password" type="password" autocomplete="current-password" required></div>
+    <p class="help">The one you sign in with, asked at every export: the file holds the domain's DKIM key and its applications' credentials.</p></div>
   <button type="submit" class="button"><i class="ti ti-download"></i>Export domain</button>
 </form>
 {{template "body_close"}}