panel-redesign: Inbound domains, domain and delete on the kit; Spam filter box

Stage 2, step 5. Written by Sonnet, reviewed by Opus.

  - Three pages named after their mockups: in-domains, in-domain,
    in-domain-delete, with typed page data (view/inbound.go), fixtures
    and tests. The engine pages inbound, inbound_domain and
    inbound_delete are gone with their templates and are off
    legacy_pages.txt.
  - The Spam filter box (plan, Who sees what). The panel now reads
    INBOUND_ANTISPAM_MILTER and INBOUND_ANTISPAM_MILTER_ACTION, with the
    semantics of build/postfix-config.sh (on only with the inbound relay
    on and a milter set; accept | tempfail). It reports them, nothing
    more:
      on   Applies to / Filter (the address, global role only) / If the
           filter is down (accepted unfiltered | deferred)
      off  one sentence; the variable is named for the global role only
    The list shows "Spam filter on|off" in its head.
  - Handlers pass typed data; routes, POST targets, field names,
    validation and authorization (global: all inbound domains; domain
    role: the assigned ones, another tenant's id is a 404; add and
    delete are global-only) are unchanged. A test saves the upstream and
    recipients forms untouched and finds the domain unchanged.

Left out of the mockups' Spam filter box and menu - no source before
inbound-antispam-panel (2.1): the engine name, the quarantine row, the
"refused at the door, see the log" row, the lists row, "Log for this
domain". Also "Checked N min ago" on the MX box: the check carries no
time.

Not done: the filter's socket on Health and Overview. internal/health
checks a unix socket by stat; the documented form of the filter's
address is inet:host:port and needs a dial that does not exist yet.

Differences from the mockups, for the owner:
  - refusals and confirmations are the kit flash above the boxes;
  - the MX tag is coloured by the check in every state; an MX that
    points elsewhere shows "In DNS now";
  - the lead of the domain page follows what is saved ("Not accepting
    mail yet: no upstream is saved");
  - the delete page lists only what the domain has;
  - /help#inbound opens Help at the top until the Help step.

Evidence
  - docs/assets/panel-redesign/evidence/in-domains.png, in-domain.png,
    in-domain-delete.png: 1440 px wide, headless Edge, real templates
    served locally with their fixtures (filter on) - NOT from the
    container (no Docker on this machine).
  - panel/audit.js on the three pages at 1440 and 1280: 352 texts
    checked, problems: [].
  - That the panel process sees the two variables inside the container
    is read from supervisord.conf and entrypoint.sh, not run.
  - go test -count=1 ./internal/web/... ./cmd/panel
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view
      ok  cmd/panel

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_inbound_test.go

@@ -82,7 +82,7 @@ func TestInboundListAndAdd(t *testing.T) {
 	if rec.Code != http.StatusOK {
 		t.Fatalf("list = %d\n%s", rec.Code, rec.Body.String())
 	}
-	if !strings.Contains(rec.Body.String(), "Add inbound domain") {
+	if !strings.Contains(rec.Body.String(), "Add a domain") {
 		t.Fatal("list missing add form")
 	}
 
@@ -158,3 +158,72 @@ func TestInboundDelete(t *testing.T) {
 		t.Fatal("domain still present")
 	}
 }
+
+// The list and the confirmation are the kit pages: the handlers fill them from
+// what is stored, and a refused add comes back on the list with what was typed.
+func TestInboundListPageFromTheStore(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "2525", "encrypt"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := st.AddInboundDomain("bare.example.com"); err != nil {
+		t.Fatal(err)
+	}
+
+	body := inboundCall(h, http.MethodGet, "/inbound/domains", nil, globalPrincipal).Body.String()
+	has(t, "list", body, `<h1 class="title is-3">Inbound domains</h1>`, `<h2>Add a domain</h2>`, `action="/inbound/domains"`,
+		`<strong>lists.example.com</strong>`, `>mx.internal:2525<`, `required</span>`, `opportunistic</span>`, `>—<`,
+		`0 addresses`, `href="/inbound/domains/`+itoa(d.ID)+`/delete"`, `2 domains`, `>MX</span>`)
+
+	rec := inboundCall(h, http.MethodPost, "/inbound/domains", url.Values{"name": {"lists.example.com"}}, globalPrincipal)
+	if rec.Code != http.StatusConflict {
+		t.Fatalf("duplicate add = %d, want 409", rec.Code)
+	}
+	has(t, "refused add", rec.Body.String(), `<div class="notification is-danger is-light">`,
+		`That inbound domain is already configured.`, `value="lists.example.com"`)
+
+	rec = inboundCall(h, http.MethodPost, "/inbound/domains", url.Values{"name": {"not a domain"}}, globalPrincipal)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("invalid add = %d, want 400", rec.Code)
+	}
+	has(t, "invalid add", rec.Body.String(), `notification is-danger`, `value="not a domain"`)
+
+	body = send(h.HandleInboundList, &globalPrincipal, http.MethodGet, "/inbound/domains?deleted=1", nil, nil).Body.String()
+	has(t, "after a delete", body, `notification is-success`, `Inbound domain deleted.`)
+}
+
+func TestInboundDeletePageNamesWhatGoesWithTheDomain(t *testing.T) {
+	h, st := inboundHandlers(t)
+	d, err := st.AddInboundDomain("lists.example.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	id := itoa(d.ID)
+
+	body := inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page", body, `<h1 class="title is-3">Delete lists.example.com</h1>`, `sp-danger-zone`,
+		`stop accepting mail for it on port 25`, `action="/inbound/domains/`+id+`/delete"`,
+		`href="/inbound/domains/`+id+`">Keep it</a>`)
+	lacks(t, "delete page of a domain with no upstream and no recipients", body, `upstream`, `recipient`)
+
+	if err := h.inbound.SetTransport(d.ID, "mx.internal", "25", "may"); err != nil {
+		t.Fatal(err)
+	}
+	if err := h.inbound.SetRecipients(d.ID, "list", []string{"a@lists.example.com", "b@lists.example.com"}); err != nil {
+		t.Fatal(err)
+	}
+	body = inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page", body, `remove its upstream and its 2 listed recipients.`)
+
+	// Recipients are only a list while the domain accepts listed addresses.
+	if err := h.inbound.SetRecipients(d.ID, "any", nil); err != nil {
+		t.Fatal(err)
+	}
+	body = inboundCall(h, http.MethodGet, "/inbound/domains/"+id+"/delete", nil, globalPrincipal).Body.String()
+	has(t, "delete page, any recipient", body, `remove its upstream.`)
+	lacks(t, "delete page, any recipient", body, `recipient`)
+}