dmarc: a report is bounded, kept per domain, and ingested one at a time

Security review of the DMARC report path (Fable, 2026-10-11), which ran
for the first time in 2.0.0. No Critical or High finding. Fixed:

- Medium: a report was bounded only as 8 MiB of XML - some 160 000
  records or one name of megabytes, all of it rows and table cells. At
  most 5 000 records (more is ErrRejected, dropped), text fields cut to
  255 bytes on a character boundary, a record's count capped.
- Medium: the cap of 500 reports was for the whole server, so a stranger
  filing under one domain's address evicted every other domain's
  reports. PruneDMARCReports counts per domain.
- Low: the pipe service ran up to default_process_limit (100) commands
  at once against the panel's database; maxproc is 1.
- Low: the reason logged for a dropped message carried the sender's
  bytes (header line, zip entry name) as they came; cut to 200 bytes and
  reduced to printable ASCII, zip entry names quoted.
- Low: SELFPOST_DATA_DIR / SELFPOST_DB_PATH with whitespace or "$" would
  reach the command through export_environment as another path; refused
  at start when DMARC ingest is on.

Left as they are, told to the owner: the parse-failure count is a
lifetime figure shown under "This week"; a report larger than the
command reads is dropped as unreadable; nested multipart is not searched.

The hub's Retention line follows the design commit before this one.
security.md: the review, and the accepted-risk entry says what a
stranger can and cannot do now. The roadmap no longer calls the review
pending.

  go vet ./cmd/... ./internal/dmarc/ ./internal/store/: ok
  go test ./cmd/... ./internal/dmarc/ ./internal/store/ ./internal/web/...: ok
  make e2e on the test server (with the port-25 scenarios of the next
  commit): ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/dmarc.go

@@ -131,14 +131,18 @@ func (s *Store) InsertDMARCReport(rep DMARCReport) (int64, error) {
 	return id, nil
 }
 
-// PruneDMARCReports enforces count and age caps.
-func (s *Store) PruneDMARCReports() error {
+// PruneDMARCReports enforces the age cap for every domain and the count cap
+// for domain. The count is kept per domain on purpose: reports are accepted
+// from anyone who knows a domain's report address, and with one cap for the
+// whole instance a stranger filing reports under one domain would push every
+// other domain's reports out.
+func (s *Store) PruneDMARCReports(domain string) error {
 	cutoff := time.Now().UTC().AddDate(0, 0, -DMARCReportsMaxAgeDays).Format(time.RFC3339)
 	if _, err := s.db.Exec(`DELETE FROM dmarc_reports WHERE received_at < ?`, cutoff); err != nil {
 		return fmt.Errorf("prune dmarc by age: %w", err)
 	}
 	var count int
-	if err := s.db.QueryRow(`SELECT COUNT(*) FROM dmarc_reports`).Scan(&count); err != nil {
+	if err := s.db.QueryRow(`SELECT COUNT(*) FROM dmarc_reports WHERE domain = ?`, domain).Scan(&count); err != nil {
 		return fmt.Errorf("count dmarc reports: %w", err)
 	}
 	if count <= DMARCReportsMaxKeep {
@@ -147,8 +151,8 @@ func (s *Store) PruneDMARCReports() error {
 	excess := count - DMARCReportsMaxKeep
 	_, err := s.db.Exec(`
 		DELETE FROM dmarc_reports WHERE id IN (
-			SELECT id FROM dmarc_reports ORDER BY received_at ASC LIMIT ?
-		)`, excess)
+			SELECT id FROM dmarc_reports WHERE domain = ? ORDER BY received_at ASC LIMIT ?
+		)`, domain, excess)
 	if err != nil {
 		return fmt.Errorf("prune dmarc by count: %w", err)
 	}

internal/store/dmarc_test.go

@@ -58,7 +58,7 @@ func TestPruneDMARCReports(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	if err := st.PruneDMARCReports(); err != nil {
+	if err := st.PruneDMARCReports("example.com"); err != nil {
 		t.Fatal(err)
 	}
 	list, _ := st.ListDMARCReports(DMARCReportScope{AllDomains: true}, 100)