panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.example.com) and not matching (example.com), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/handlers_apps.go

@@ -7,6 +7,8 @@ import (
 	"strconv"
 	"strings"
 
+	"codeberg.org/mix/selfpost/internal/dnscheck"
+	"codeberg.org/mix/selfpost/internal/domain"
 	"codeberg.org/mix/selfpost/internal/store"
 )
 
@@ -100,6 +102,10 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 		"Active": "domains",
 		"Domain": d,
 		"Record": record,
+		// What DNS actually publishes for the domain today, checked against the
+		// key this server signs with (phase 13.B). Cached by the checker, so
+		// re-rendering the page after a form post costs nothing.
+		"DNS": s.domainDNS(d, record, false),
 		// Client connection settings (the same for every domain on this
 		// instance): the hostname clients connect to, and whether the optional
 		// submission listener is enabled in this deployment.
@@ -122,6 +128,38 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 	})
 }
 
+// domainDNS resolves what the world sees for a domain: its DKIM, SPF and DMARC
+// records (phase 13.B). The server's own address comes from the (separately
+// cached) hostname check, so the SPF heuristic knows which IP it is looking for
+// and no extra environment variable is needed. force bypasses the cache, for the
+// Re-check button.
+func (s *Server) domainDNS(d store.Domain, record domain.DKIMRecord, force bool) dnscheck.Domain {
+	srv := s.dns.Server(s.cfg.Hostname, false)
+	return s.dns.Domain(dnscheck.Query{
+		Name:         d.Name,
+		Selector:     d.DKIMSelector,
+		ExpectedDKIM: record.Value,
+		ServerIPs:    srv.IPs,
+	}, force)
+}
+
+// handleDomainDNSRecheck re-runs the domain's DNS checks ignoring the cache and
+// returns to its page, which then renders the fresh result.
+func (s *Server) handleDomainDNSRecheck(w http.ResponseWriter, r *http.Request) {
+	d, ok := s.lookupDomain(w, r)
+	if !ok {
+		return
+	}
+	record, err := s.domains.DKIMRecord(d)
+	if err != nil {
+		logf("panel: domain %d: dkim record: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	s.domainDNS(d, record, true)
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?rechecked=1", d.ID), http.StatusSeeOther)
+}
+
 // intOrBlank renders a non-positive number as an empty string so an unset field
 // shows blank rather than "0".
 func intOrBlank(n int) string {
@@ -152,6 +190,8 @@ func detailFlash(r *http.Request) string {
 		return "Rate limit updated."
 	case r.URL.Query().Get("imported") != "":
 		return "Domain imported. Its DKIM DNS record is unchanged — no DNS update is needed."
+	case r.URL.Query().Get("rechecked") != "":
+		return "DNS re-checked."
 	default:
 		return ""
 	}