Phase 8: level-2 differentiated rate limits (spec 7.4)

The journal-milter, until now a pure monitor, now refuses a message with a
4xx tempfail (RespTempFail/451) at MAIL FROM when a per-domain or per-
application limit is exceeded. Key is the client IP; the count is
COUNT(DISTINCT queue_id) over a sliding window reusing the send log; the
limit applies only when a non-empty IP binding matches the client (empty
binding => level-1 only, per spec 7.4). Enforcement is fail-open on the
milter's own errors — a limiter malfunction never blocks mail, and Postfix's
level-1 anvil limit stays the independent backstop. Refused messages are
recorded in send_log with status "rejected" for UI visibility.

- store/ratelimits.go: RateLimit type (+Active/AllowsIP), id-keyed get/set/
  delete for the panel, name/login-keyed lookup + windowed distinct-message
  count for the milter, DeleteRateLimitsForDomain. No migration — the
  rate_limits table has existed since Phase 2.
- milter: enforce at MailFrom, fail-open helper overLimit, InsertRejected.
- web: server-side validated IP/ceiling/window forms on the domain page and
  per application; routes POST /domains/{id}/ratelimit and
  /applications/{aid}/ratelimit. Milter reads rows live, so no reload.
- domain/app services clear limits on deletion (rate_limits has no FK cascade).

Unit tests + container e2e (p8) green: refusal on both scopes, unregistered
IP ignored, fail-open with the panel stopped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/app/service.go

@@ -140,9 +140,38 @@ func (s *Service) Delete(id int64) error {
 	if err := s.sasl.Delete(a.Login); err != nil {
 		return err
 	}
+	// Drop the application's level-2 limit, if any (spec 7.4); rate_limits has no
+	// cascade of its own.
+	if err := s.store.DeleteRateLimit(store.RateLimitScopeApp, id); err != nil {
+		return err
+	}
 	return s.Resync()
 }
 
+// RateLimit returns the application-level differentiated rate limit (spec 7.4),
+// and whether one is configured, for the application's edit form.
+func (s *Service) RateLimit(appID int64) (store.RateLimit, bool, error) {
+	return s.store.GetRateLimit(store.RateLimitScopeApp, appID)
+}
+
+// SaveRateLimit stores the application-level rate limit. The caller has validated
+// the IPs and numbers (spec 7.6.2); the milter reads the row live, so no reload
+// is needed.
+func (s *Service) SaveRateLimit(appID int64, ips []string, maxMessages, windowSeconds int) error {
+	return s.store.SetRateLimit(store.RateLimit{
+		Scope:         store.RateLimitScopeApp,
+		RefID:         appID,
+		AllowedIPs:    ips,
+		MaxMessages:   maxMessages,
+		WindowSeconds: windowSeconds,
+	})
+}
+
+// ClearRateLimit removes the application-level rate limit (spec 7.4).
+func (s *Service) ClearRateLimit(appID int64) error {
+	return s.store.DeleteRateLimit(store.RateLimitScopeApp, appID)
+}
+
 // PurgeDomainSASL removes the SASL accounts of every application bound to a
 // domain. It must be called before the domain's registry rows are cascade-
 // deleted, while the logins are still known (spec 7.2.4). The registry rows and