panel: clearer L1 rate-limit display and status badges

Show the level-1 backstop as its own line and code-row, use st badges for
active/inactive domain and app limits, and fold the polish into 1.2.4.

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -7,8 +7,8 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [1.2.4] - 2026-08-12
 
-Level-2 rate-limit semantics inverted after 1.2.3, plus a small DNS field
-height fix. Upgrading is a tag bump; no migration.
+Level-2 rate-limit semantics inverted after 1.2.3, with clearer L1 display and
+status badges. Upgrading is a tag bump; no migration.
 
 ### Changed
 
@@ -20,6 +20,10 @@ height fix. Upgrading is a tag bump; no migration.
   level-1 backstop on domain/application forms and Settings, rejects maxima
   above level 1, and requires an application override to exceed the domain
   maximum. Operator guide and architecture updated.
+- panel: level-1 backstop is shown as a dedicated line (`N messages / Ws`) and
+  in message-limit labels; Settings uses a code-row for the L1 value. Domain
+  and application rate-limit status uses the shared `st` badge (`active` /
+  `inactive — level 1 only`). Trusted-IP override copy is a single paragraph.
 
 ### Fixed