release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/milter/authip.go

@@ -0,0 +1,31 @@
+package milter
+
+import (
+	"errors"
+	"log"
+
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// authIPAllowed reports whether the authenticated application may submit from
+// the connecting client IP. When the application has no IP restriction, or the
+// client IP is not known, the check passes. Store errors are fail-open (see
+// overLimit).
+func (s *session) authIPAllowed() bool {
+	if s.login == "" || s.clientIP == "" {
+		return true
+	}
+	a, err := s.rec.ApplicationByLogin(s.login)
+	if err != nil {
+		if errors.Is(err, store.ErrApplicationNotFound) {
+			return true
+		}
+		log.Printf("journal-milter: auth IP lookup application %q: %v (fail-open)", s.login, err)
+		return true
+	}
+	if a.AllowsAuthFromIP(s.clientIP) {
+		return true
+	}
+	log.Printf("journal-milter: application %q refused from %s — client IP not allowed", s.login, s.clientIP)
+	return false
+}