user form, backup: two gaps the mockup comparison found

Owner, 2026-10-18: "Что ещё из макетов мы также прошляпили?" - every mockup
held against the panel; two small gaps beyond the queues:

- user.html: with All ticked, a list's single domains are disabled
  (mockup user.html:34-36). A panel.js show-when rule with disable: the
  boxes data-single-out / data-single-in follow data-all-out / data-all-in,
  at load and on change; a disabled box is not submitted, which the server
  ignores with All anyway. node test testdata/alldomains_test.js (fails on
  the previous panel.js).
- backup.html: "domain's settings" is a link, to Outbound › Domains (mockup
  backup.html:35 links a domain's settings; a server page has no one domain).

Tests: go test ./internal/web/... pass, TestPanelJS with node 24.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -31,6 +31,19 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   must be named in `docs/roadmap.md`. The two queues had been deferred on
   2026-10-09 with no roadmap row and were forgotten; development.md says so.
 
+### Fixed
+
+Two gaps a comparison of every mockup with the panel found (the rest
+matches):
+
+- **Server › Users, the user form:** with *All outbound domains* (or *All
+  inbound domains*) ticked, that list's single domains are disabled, as the
+  mockup draws them - the server ignored them already, which the help line
+  says. panel.js does it; without scripts they stay clickable.
+- **Server › Backup, Import a domain:** "the domain's settings" links to
+  Outbound › Domains, where each domain's settings are, as the mockup's link
+  does.
+
 ## [2.15.0] - 2026-10-18
 
 The two proposals the security audit left as product choices. Migration