release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/store/migrations/0009_application_auth_ips.sql

@@ -0,0 +1,22 @@
+-- Client IP restriction for application SASL authorization (independent of
+-- level-2 rate limits). When enabled, only listed IPs may submit mail as the
+-- application; when disabled, any client IP is allowed.
+
+ALTER TABLE applications ADD COLUMN auth_ip_restrict INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE applications ADD COLUMN auth_allowed_ips TEXT;
+
+-- Migrate trusted IPs from application rate_limits into auth_allowed_ips.
+UPDATE applications
+SET auth_ip_restrict = 1,
+    auth_allowed_ips = (
+        SELECT allowed_ips FROM rate_limits
+        WHERE scope = 'application' AND ref_id = applications.id
+    )
+WHERE EXISTS (
+    SELECT 1 FROM rate_limits
+    WHERE scope = 'application' AND ref_id = applications.id
+      AND allowed_ips IS NOT NULL AND TRIM(allowed_ips) != ''
+);
+
+UPDATE rate_limits SET allowed_ips = NULL
+WHERE scope = 'application' AND allowed_ips IS NOT NULL;