release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/milter/milter.go

@@ -35,6 +35,7 @@ type Store interface {
 	InsertRejected(e store.SendLogEntry) error
 	RateLimit(scope, ref string) (store.RateLimit, bool, error)
 	CountMessages(scope, ref string, since time.Time) (int64, error)
+	ApplicationByLogin(login string) (store.Application, error)
 }
 
 // session accumulates the fields of one message as the milter callbacks fire.
@@ -84,6 +85,10 @@ func (s *session) MailFrom(from string, m *milter.Modifier) (milter.Response, er
 	s.login = macro(m, "auth_authen")
 	s.rcpts = nil
 	s.subject = ""
+	if !s.authIPAllowed() {
+		s.recordRejected()
+		return milter.RespTempFail, nil
+	}
 	if s.overLimit() {
 		s.recordRejected()
 		return milter.RespTempFail, nil