inbound-antispam-panel: Filter lists, kind column, matches, note on a sheet

Follows the design commit before it (owner's words quoted there).

The lists' tables are Value, Kind, Matched and Remove. The kind tag
opens the entry's sheet: note, day added, how often it decided a
message in the days the log keeps, and the last match.

Matches are read off the journal on each view, nothing is stored
(inbound.Lists.Usage, store.ListSpamListHits). A row counts for an
entry when the list decided the message - a rejected row whose reply is
the deny rule's message, an accepted row whose verdict carries the
allow rule's symbol for that kind - and the entry fits the row's sender
or client address the way rspamd matches it: an address whole, a domain
as the sender's domain, a network containing the client (an
IPv4-mapped address as IPv4). A failure to count shows the lists with
"never" and logs why.

For that the journal milter keeps the lists' own symbols ahead of its
six-symbol cap: rspamd writes symbols heaviest first, so an allow
entry's -100 came last and was cut behind any six others.

The plan gains "Filter list usage": what counting from the journal
implies, and - the owner asked for it in writing - the conditions under
which a counter kept with each entry becomes worth a migration (the
journal cut by its row cap and not by age; a short retention; counts
that must outlive the journal; a slow page). multimap.conf says which
of its texts SelfPost reads back.

Tests: Usage over every kind on both lists and the rows that are
nobody's; the milter's symbol order; the store query; the page and its
sheets; a handler test from journal rows to the numbers on the page.

Seen: the fixture page with a sheet open, headless Edge at 1360 px -
the same as the accepted drawing.

Checked on the test server, uncommitted tree: go vet ./... ok,
go test ./... ok (22 packages), make e2e ok.

Not seen in a real run: a count above zero. It needs an entry added in
the panel, which I cannot sign in to, and then mail that the list
decides; in particular the deny rule's message arriving in mail.log as
the reply of a milter-reject line is what the trial with rspamc showed,
not yet what Postfix logged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/inbound_log_test.go

@@ -183,18 +183,27 @@ func TestFilterListsShowsTheFormTheListsAndWhereTheyGo(t *testing.T) {
 		`href="/help#filter-lists" title="How the lists are applied"`,
 		`<h2>Deny</h2><div class="sp-end">3 entries · wins over Allow</div>`,
 		`<h2>Allow</h2><div class="sp-end">2 entries</div>`,
-		`<td class="sp-mono sp-small">bulk.example <span class="tag is-light">domain</span></td><td class="sp-muted">newsletter nobody subscribed to</td><td class="sp-muted sp-nowrap sp-small">2026-09-02</td>`,
-		`198.51.100.0/24 <span class="tag is-light">ip</span>`,
-		`win@lottery.example <span class="tag is-light">address</span></td><td class="sp-muted">—</td>`,
+		`<thead><tr><th>Value</th><th>Kind</th><th>Matched</th><th></th></tr></thead>`,
+		// the kind is a tag that opens the entry's sheet; the count is beside it
+		`<td class="sp-mono sp-small">bulk.example</td><td><button type="button" class="tag is-light" popovertarget="entry-1">domain</button><div class="sp-sheet" id="entry-1" popover>`,
+		`<div class="sp-sheet-head"><span class="tag is-light">domain</span><h2>bulk.example</h2>`,
+		`<tr><th>Note</th><td>newsletter nobody subscribed to</td></tr><tr><th>Added</th><td class="sp-mono sp-small">2026-09-02</td></tr><tr><th>Matched</th><td>41 in the last 90 days</td></tr><tr><th>Last match</th><td class="sp-mono sp-small">2026-09-21 13:57</td></tr></tbody>`,
+		`</div></td><td class="sp-nowrap">41</td><td class="sp-actions">`,
+		`<td class="sp-nowrap">1203</td>`,
+		// an entry that never decided anything says so, in the row and on its sheet
+		`<td class="sp-mono sp-small">win@lottery.example</td><td><button type="button" class="tag is-light" popovertarget="entry-3">address</button>`,
+		`<tr><th>Note</th><td>—</td></tr><tr><th>Added</th><td class="sp-mono sp-small">2026-07-30</td></tr><tr><th>Matched</th><td>never in the last 90 days</td></tr></tbody>`,
+		`</div></td><td class="sp-muted sp-nowrap">never</td><td class="sp-actions">`,
 		`<form method="post" action="/inbound/filter-lists/3/delete"><button type="submit" class="has-text-danger">Remove</button></form>`,
 		`<h2>Where the lists go</h2><div class="sp-end"><span class="tag is-success is-light">applied</span></div>`,
 		`rspamd, from map files it rereads within seconds of a change`,
 		`<span class="sp-mono">/data/antispam/</span> — six, one for each list and kind of entry`,
 		`2026-09-11 08:40 UTC`, `Deny wins, whichever entries they are.`,
 	)
-	if got := strings.Count(out, `<table`); got != 2 {
-		t.Errorf("%d tables, want the two lists", got)
+	if got := strings.Count(out, `<table class="table is-fullwidth is-hoverable">`); got != 2 {
+		t.Errorf("%d list tables, want the two lists", got)
 	}
+	pageLacks(t, "Filter lists", out, `<th>Note</th><th>`, `<th>Added</th><th>`)
 }
 
 // With no filter attached the lists are still the operator's to edit, and the
@@ -213,8 +222,8 @@ func TestFilterListsOffAndEmpty(t *testing.T) {
 		`No sender is turned away by hand.`,
 	)
 	pageLacks(t, "Filter lists", out, `rspamd, from map files`, `is-success is-light">applied`, `No sender is let through by hand.`)
-	if got := strings.Count(out, `<table`); got != 1 {
-		t.Errorf("%d tables, want the one list that has entries", got)
+	if got := strings.Count(out, `<table class="table is-fullwidth is-hoverable">`); got != 1 {
+		t.Errorf("%d list tables, want the one list that has entries", got)
 	}
 }