Phase 8: level-2 differentiated rate limits (spec 7.4)

The journal-milter, until now a pure monitor, now refuses a message with a
4xx tempfail (RespTempFail/451) at MAIL FROM when a per-domain or per-
application limit is exceeded. Key is the client IP; the count is
COUNT(DISTINCT queue_id) over a sliding window reusing the send log; the
limit applies only when a non-empty IP binding matches the client (empty
binding => level-1 only, per spec 7.4). Enforcement is fail-open on the
milter's own errors — a limiter malfunction never blocks mail, and Postfix's
level-1 anvil limit stays the independent backstop. Refused messages are
recorded in send_log with status "rejected" for UI visibility.

- store/ratelimits.go: RateLimit type (+Active/AllowsIP), id-keyed get/set/
  delete for the panel, name/login-keyed lookup + windowed distinct-message
  count for the milter, DeleteRateLimitsForDomain. No migration — the
  rate_limits table has existed since Phase 2.
- milter: enforce at MailFrom, fail-open helper overLimit, InsertRejected.
- web: server-side validated IP/ceiling/window forms on the domain page and
  per application; routes POST /domains/{id}/ratelimit and
  /applications/{aid}/ratelimit. Milter reads rows live, so no reload.
- domain/app services clear limits on deletion (rate_limits has no FK cascade).

Unit tests + container e2e (p8) green: refusal on both scopes, unregistered
IP ignored, fail-open with the panel stopped.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/domain/service.go

@@ -100,6 +100,12 @@ func (s *Service) Delete(id int64) error {
 	if err := s.apps.PurgeDomainSASL(id); err != nil {
 		return fmt.Errorf("clear SASL accounts for %s: %w", d.Name, err)
 	}
+	// Drop the domain's own level-2 limit and those of its applications while the
+	// application rows still exist (the cleanup query joins them). rate_limits has
+	// no cascade of its own (ref_id is a plain integer, spec 7.4/9).
+	if err := s.store.DeleteRateLimitsForDomain(id); err != nil {
+		return fmt.Errorf("clear rate limits for %s: %w", d.Name, err)
+	}
 	if err := s.store.DeleteDomain(id); err != nil {
 		return err
 	}
@@ -122,6 +128,31 @@ func (s *Service) DKIMRecord(d store.Domain) (DKIMRecord, error) {
 	return s.odk.Record(d.Name, d.DKIMSelector)
 }
 
+// RateLimit returns the domain-level differentiated rate limit (spec 7.4), and
+// whether one is configured, for the domain's edit form.
+func (s *Service) RateLimit(domainID int64) (store.RateLimit, bool, error) {
+	return s.store.GetRateLimit(store.RateLimitScopeDomain, domainID)
+}
+
+// SaveRateLimit stores the domain-level rate limit. The caller has validated the
+// IPs and numbers (spec 7.6.2); the milter reads the row live, so no reload is
+// needed.
+func (s *Service) SaveRateLimit(domainID int64, ips []string, maxMessages, windowSeconds int) error {
+	return s.store.SetRateLimit(store.RateLimit{
+		Scope:         store.RateLimitScopeDomain,
+		RefID:         domainID,
+		AllowedIPs:    ips,
+		MaxMessages:   maxMessages,
+		WindowSeconds: windowSeconds,
+	})
+}
+
+// ClearRateLimit removes the domain-level rate limit, falling back to level 1
+// only (spec 7.4).
+func (s *Service) ClearRateLimit(domainID int64) error {
+	return s.store.DeleteRateLimit(store.RateLimitScopeDomain, domainID)
+}
+
 // Resync regenerates the OpenDKIM tables from the registry and reloads OpenDKIM.
 // It backs the manual reload button (spec 7.2.12) and doubles as a recovery path
 // if the tables ever drift from the database.