panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.example.com) and not matching (example.com), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -5,6 +5,24 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+- panel: new **Status** page — supervised processes, mail queue, TLS
+  certificate expiry, milter sockets and the server's own hostname/reverse-DNS
+  (FCrDNS) check — and it is now the panel's landing page. The local checks
+  refresh by polling; the DNS lookup is cached with a *Re-check* button.
+- panel: the domain page shows a **DNS status** card: the published DKIM record
+  compared against the key this server actually signs with, plus SPF and DMARC.
+  The SPF check is deliberately shallow — it looks for a mechanism literally
+  covering this server's address and does not follow `include:`/`redirect=`, so
+  a record that authorises the server through an include is reported as "cannot
+  tell", not as a failure.
+- panel: the domain list moved from `/` to `/domains`; `/` redirects to the
+  status page. The **Reload** button moved from the domain list to the status
+  page and now explains what it regenerates and when to use it.
+- fix: the panel could never read the mail queue in the documented deployment.
+  `postqueue` relies on its setgid-`postdrop` bit, which `no-new-privileges`
+  (set in the shipped compose file) disables, so the *Queue* screen always said
+  "Could not read the mail queue". The `panel` user is now a real member of
+  `postdrop`.
 - panel: navigation bar is now rendered once from the shared layout, so every
   authenticated page has it — including the domain page and the delete
   confirmation, which had no navigation links at all — and the current page is