postfix: no reload for a map that did not change; DNS re-checks limited (audit W6/M9)

Security audit 2026-10-17, findings W6/M9 (low), stage 4. Every
application, upstream, recipient or report-address save reloaded Postfix
through supervisord, and POST .../dns-recheck bypassed the five-minute
cache for up to ~14 resolver queries - both at whatever rate an
authenticated user pressed.

- writeChanged: each generated map is written only when its content
  differs from the file on disk, and Postfix is reloaded only when one was
  (sender map, inbound maps, DMARC maps). Health's Reload configuration
  ends with an explicit reload (app.Service.ReloadPostfix, SenderMaps
  gains Reload), so it still re-reads whatever is on disk. No debounce:
  with unchanged saves gone, a burst is real changes Postfix must see.
- auth.AllowDNSRecheck: twenty forced re-checks in 15 minutes per user;
  past that the outbound, inbound and settings re-check show the cached
  result without the "re-checked" flash, and the log says why.

Tests: TestARebuildThatChangesNothingDoesNotReload,
TestDNSRechecksArePerUser; the fakes gain Reload. Docs: guide § Overview
and Health; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -804,9 +804,14 @@ the argument.
   SelfPost (Postfix's default_process_limit of 100 per service, three smtpd
   services), 256 for the proxies and rspamd, 64 for certbot; e2e reads
   `pids.max` back (checkPidsLimit).
-- [ ] **W6/M9.** Coalesce Postfix reloads (reload only when the rendered map
+- [x] **W6/M9.** Coalesce Postfix reloads (reload only when the rendered map
   changed; a 2 s debounce for bursts); a per-user limiter on `dns-recheck`.
-  — **Opus**, 1.5 h.
+  — **Opus**, 1.5 h. *Done 2026-10-17:* a rebuild that changes no file
+  writes nothing and asks no reload (`writeChanged`), Health's button
+  re-reads in any case; no debounce - with unchanged saves gone, a burst is
+  real changes, each of which Postfix must see; twenty re-checks in 15
+  minutes per user, then the cached result. TestARebuildThatChangesNothingDoesNotReload,
+  TestDNSRechecksArePerUser.
 - [ ] **W4/W5/W8.** Key size 1024-4096 on import; ≤ 500 applications per
   export; an import named as the hostname refused with a sentence. —
   **Sonnet**, 1.5 h.