panel-notifications: the notifier, its mail and the server's own DKIM key

internal/notify applies the owner's rules. Each subject has a row of state,
so a thing is said once and a restart says nothing again:

- DNS of a sending domain: said after two hourly checks in a row found a
  record wrong, said to be over after two found it right. A lookup that did
  not answer moves nothing; a warning (no DMARC record) is not a subject.
- TLS certificate: at 14 days and at 3, per certificate.
- Queue: a message older than three days, once; once more when none is.
- Level-2 limit: from the rejected rows of the send log, every five minutes;
  at most once a day per domain and application.

Global users are told everything, domain users about their domains; one
message per recipient. With the instance switch off nothing is checked and no
state moves. A message that could not be handed to Postfix is tried again at
the next check.

Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--",
no shell. For it to be believed the server's own name is signed like a
sending domain: domain.Service keeps a key for it and a line in OpenDKIM's
tables without a registry row, and non_smtpd_milters now names OpenDKIM. A
sending domain of the same name shares its key with the server.
dnscheck.ServerMail checks the name's DKIM and SPF records;
postfix.QueueMessages reads postqueue -j for arrival times.

The notifier is a sixth role of the panel process. Nothing in the panel
shows or switches it yet.

Checked on Windows: go vet clean; go test passes for notify, store, postfix,
dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which
fails there on file modes and always did. Not yet run in a container: whether
the unprivileged panel may submit is for the e2e step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/postfix/queuejson.go

@@ -0,0 +1,86 @@
+package postfix
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+	"strings"
+	"time"
+)
+
+// QueuedMessage is one message Postfix is holding, as `postqueue -j` reports
+// it: where it is, and since when.
+type QueuedMessage struct {
+	ID      string
+	Queue   string // "deferred", "active", "hold", "incoming", "maildrop"
+	Sender  string
+	Arrival time.Time
+}
+
+// readQueueJSON runs `postqueue -j`. It is a var so tests can answer without a
+// running Postfix, the way readRetryConf is.
+var readQueueJSON = postqueueJSON
+
+func postqueueJSON() ([]byte, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), postqueueTimeout)
+	defer cancel()
+	// A fixed flag and no user input, never through a shell (security.md).
+	cmd := exec.CommandContext(ctx, "postqueue", "-j")
+	out := &limitWriter{remaining: maxQueueOutput}
+	errOut := &limitWriter{remaining: 4096}
+	cmd.Stdout = out
+	cmd.Stderr = errOut
+	err := cmd.Run()
+	if ctx.Err() == context.DeadlineExceeded {
+		return nil, fmt.Errorf("postqueue -j timed out after %s", postqueueTimeout)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("postqueue -j: %w: %s", err, strings.TrimSpace(errOut.buf.String()))
+	}
+	// A listing cut at the size limit is still a list of whole lines up to the
+	// cut; the last, broken one is dropped by the parser.
+	return out.buf.Bytes(), nil
+}
+
+// QueueMessages returns the messages Postfix holds with the time each arrived,
+// for the notification about mail that has waited too long. An error means the
+// queue could not be listed and says nothing about any message.
+func QueueMessages() ([]QueuedMessage, error) {
+	out, err := readQueueJSON()
+	if err != nil {
+		return nil, err
+	}
+	return parseQueueJSON(out), nil
+}
+
+// parseQueueJSON reads `postqueue -j` output: one JSON object per line. A line
+// that is not one - the tail of a listing cut at its size limit - is skipped.
+func parseQueueJSON(out []byte) []QueuedMessage {
+	var msgs []QueuedMessage
+	sc := bufio.NewScanner(strings.NewReader(string(out)))
+	sc.Buffer(make([]byte, 0, 64*1024), 1<<20)
+	for sc.Scan() {
+		line := strings.TrimSpace(sc.Text())
+		if line == "" {
+			continue
+		}
+		var e struct {
+			QueueName   string `json:"queue_name"`
+			QueueID     string `json:"queue_id"`
+			ArrivalTime int64  `json:"arrival_time"`
+			Sender      string `json:"sender"`
+		}
+		if err := json.Unmarshal([]byte(line), &e); err != nil || e.QueueID == "" || e.ArrivalTime <= 0 {
+			continue
+		}
+		msgs = append(msgs, QueuedMessage{
+			ID:      e.QueueID,
+			Queue:   e.QueueName,
+			Sender:  e.Sender,
+			Arrival: time.Unix(e.ArrivalTime, 0).UTC(),
+		})
+	}
+	return msgs
+}

internal/postfix/queuejson_test.go

@@ -0,0 +1,43 @@
+package postfix
+
+import (
+	"errors"
+	"testing"
+	"time"
+)
+
+func TestParseQueueJSON(t *testing.T) {
+	out := []byte(`{"queue_name": "deferred", "queue_id": "41E862C00D9E", "arrival_time": 1791000000, "message_size": 446, "forced_expire": false, "sender": "app@example.com", "recipients": [{"address": "a@example.net", "delay_reason": "connect to mx.example.net[203.0.113.9]:25: Connection timed out"}]}
+{"queue_name": "active", "queue_id": "5F00AA12", "arrival_time": 1791250000, "message_size": 900, "sender": "", "recipients": [{"address": "b@example.net"}]}
+
+not json at all
+{"queue_name": "deferred", "queue_id": "", "arrival_time": 1791250000}
+{"queue_name": "deferred", "queue_id": "6C00BB34", "arrival_time": 17912`)
+
+	got := parseQueueJSON(out)
+	if len(got) != 2 {
+		t.Fatalf("parsed %d messages, want 2: %+v", len(got), got)
+	}
+	if got[0].ID != "41E862C00D9E" || got[0].Queue != "deferred" || got[0].Sender != "app@example.com" ||
+		!got[0].Arrival.Equal(time.Unix(1791000000, 0)) {
+		t.Errorf("first message = %+v", got[0])
+	}
+	if got[1].ID != "5F00AA12" || got[1].Queue != "active" {
+		t.Errorf("second message = %+v", got[1])
+	}
+	if len(parseQueueJSON(nil)) != 0 {
+		t.Error("an empty queue is not empty")
+	}
+}
+
+// A queue that cannot be listed is an error, not an empty queue: the caller
+// must not conclude that nothing is waiting.
+func TestQueueMessagesReportsAFailedListing(t *testing.T) {
+	old := readQueueJSON
+	t.Cleanup(func() { readQueueJSON = old })
+	readQueueJSON = func() ([]byte, error) { return nil, errors.New("postqueue: Permission denied") }
+
+	if msgs, err := QueueMessages(); err == nil {
+		t.Fatalf("no error for a failed listing (got %v)", msgs)
+	}
+}