panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.example.com) and not matching (example.com), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/health/processes.go

@@ -0,0 +1,99 @@
+package health
+
+import (
+	"fmt"
+	"os/exec"
+	"strings"
+)
+
+// supervisorConf is the supervisord configuration the panel's other control
+// calls already address (see internal/postfix and internal/domain).
+const supervisorConf = "/etc/supervisor/supervisord.conf"
+
+// oneShotPrograms are supervisord entries that are meant to sit idle: they are
+// started on demand and exit immediately, so STOPPED/EXITED is their healthy
+// state rather than a fault (see build/supervisord.conf).
+var oneShotPrograms = map[string]bool{
+	"postfix-reload": true,
+}
+
+// Process is one supervised program as supervisord reports it.
+type Process struct {
+	Name   string
+	State  string // supervisord's own state word, e.g. RUNNING
+	Detail string // the rest of the line: pid/uptime, or exit information
+	Status Status
+}
+
+// Processes returns the state of every supervised program (spec 4's three
+// processes plus the reload/cert/logrotate helpers).
+//
+// The command takes fixed arguments and no user input, so it never goes through
+// a shell (spec 7.6.3). `supervisorctl status` deliberately exits non-zero when
+// some program is not running, so the output is parsed first and the exit status
+// only matters when nothing could be parsed from it.
+func Processes() ([]Process, error) {
+	cmd := exec.Command("supervisorctl", "-c", supervisorConf, "status")
+	out, err := cmd.CombinedOutput()
+	procs := parseProcesses(string(out))
+	if len(procs) == 0 {
+		if err != nil {
+			return nil, fmt.Errorf("supervisorctl status: %w: %s", err, strings.TrimSpace(string(out)))
+		}
+		return nil, fmt.Errorf("supervisorctl status: no programs reported")
+	}
+	return procs, nil
+}
+
+// supervisorStates are the state words supervisord prints. Lines whose second
+// field is not one of them are not status lines (banners, error text) and are
+// skipped, so unexpected output cannot masquerade as a process.
+var supervisorStates = map[string]bool{
+	"STOPPED":  true,
+	"STARTING": true,
+	"RUNNING":  true,
+	"BACKOFF":  true,
+	"STOPPING": true,
+	"EXITED":   true,
+	"FATAL":    true,
+	"UNKNOWN":  true,
+}
+
+// parseProcesses turns supervisorctl's tabular output into Process values. Each
+// status line is "<name> <STATE> <detail...>", column-aligned with spaces.
+func parseProcesses(out string) []Process {
+	var procs []Process
+	for _, line := range strings.Split(out, "\n") {
+		fields := strings.Fields(line)
+		if len(fields) < 2 || !supervisorStates[fields[1]] {
+			continue
+		}
+		name, state := fields[0], fields[1]
+		procs = append(procs, Process{
+			Name:   name,
+			State:  state,
+			Detail: strings.Join(fields[2:], " "),
+			Status: processStatus(name, state),
+		})
+	}
+	return procs
+}
+
+// processStatus grades a supervisord state. A one-shot program that is not
+// running is healthy; anything else that is not RUNNING means a component of
+// the mail path is down or flapping.
+func processStatus(name, state string) Status {
+	switch state {
+	case "RUNNING":
+		return StatusOK
+	case "STARTING", "STOPPING":
+		return StatusWarn
+	case "STOPPED", "EXITED":
+		if oneShotPrograms[name] {
+			return StatusOK
+		}
+		return StatusError
+	default: // BACKOFF, FATAL, UNKNOWN
+		return StatusError
+	}
+}