panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.example.com) and not matching (example.com), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/health/socket.go

@@ -0,0 +1,56 @@
+package health
+
+import (
+	"fmt"
+	"os"
+)
+
+// Socket is the state of one milter socket Postfix connects to.
+type Socket struct {
+	Name    string
+	Path    string
+	Present bool
+	Status  Status
+	Detail  string
+}
+
+// CheckSocket stats a milter socket. required distinguishes the two milters:
+// OpenDKIM runs with default_action=tempfail, so a missing socket stops mail
+// leaving the server, while the journal-milter fails open — mail still goes out,
+// only the send log stops being written.
+func CheckSocket(name, path string, required bool) Socket {
+	s := Socket{Name: name, Path: path}
+	if path == "" {
+		s.Status = StatusUnknown
+		s.Detail = "No socket path is configured."
+		return s
+	}
+	fi, err := os.Stat(path)
+	switch {
+	case err != nil:
+		s.Status = missingStatus(required)
+		s.Detail = missingDetail(name, required)
+	case fi.Mode()&os.ModeSocket == 0:
+		s.Status = missingStatus(required)
+		s.Detail = fmt.Sprintf("%s exists but is not a socket.", path)
+	default:
+		s.Present = true
+		s.Status = StatusOK
+		s.Detail = "Listening."
+	}
+	return s
+}
+
+func missingStatus(required bool) Status {
+	if required {
+		return StatusError
+	}
+	return StatusWarn
+}
+
+func missingDetail(name string, required bool) string {
+	if required {
+		return fmt.Sprintf("The %s socket is missing. Postfix rejects mail with a temporary error until it is back.", name)
+	}
+	return fmt.Sprintf("The %s socket is missing. Mail still goes out, but the send log is not being written.", name)
+}