dmarc: no custom report address on the server's own name (audit W1)

Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/service_test.go

@@ -32,11 +32,21 @@ func TestAllowedRecipientsFollowTheDomainAddresses(t *testing.T) {
 		t.Fatal(err)
 	}
 
+	// Another domain's hosted address, stored for this one: no mailbox
+	// either (W1's second shape).
+	stolen, _ := st.AddDomain("stolen.example", "sel")
+	if err := st.SetDomainDMARCAddress(stolen.ID, HostedReportAddress("mail.example.com", "victim.example")); err != nil {
+		t.Fatal(err)
+	}
+
 	got, err := NewService(st, nil, "mail.example.com", true).AllowedRecipients()
 	if err != nil {
 		t.Fatalf("AllowedRecipients: %v", err)
 	}
-	want := []string{"dmarc-reports+hosted.example@mail.example.com", "ops@mail.example.com"}
+	// Only the hosted address of the domain that chose it: an address typed
+	// on the server's name (ops@) opens nothing (security audit 2026-10-17,
+	// W1; this test asserted the opposite until then).
+	want := []string{"dmarc-reports+hosted.example@mail.example.com"}
 	if !reflect.DeepEqual(got, want) {
 		t.Errorf("allowed recipients = %v, want %v", got, want)
 	}