release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/store/ratelimit_auto.go

@@ -92,8 +92,6 @@ func (s *Store) recalcAutoRateLimit(rl RateLimit, retentionDays, l1Max, l1Window
 	}
 
 	var stats SendStats
-	var domainMax int
-	var domainActive bool
 
 	switch rl.Scope {
 	case RateLimitScopeDomain:
@@ -114,22 +112,11 @@ func (s *Store) recalcAutoRateLimit(rl RateLimit, retentionDays, l1Max, l1Window
 		if err != nil {
 			return err
 		}
-		domainRL, ok, err := s.GetRateLimit(RateLimitScopeDomain, a.DomainID)
-		if err != nil {
-			return err
-		}
-		domainActive = ok && domainRL.Active()
-		if domainActive {
-			domainMax = domainRL.MaxMessages
-		}
 	default:
 		return fmt.Errorf("unknown scope %q", rl.Scope)
 	}
 
 	maxMsgs := computeAutoMaxMessages(stats, mult, l1Max)
-	if rl.Scope == RateLimitScopeApp {
-		maxMsgs = adjustAppAutoMax(maxMsgs, domainMax, domainActive, l1Max)
-	}
 
 	rl.MaxMessages = maxMsgs
 	rl.WindowSeconds = l1Window
@@ -152,15 +139,3 @@ func computeAutoMaxMessages(stats SendStats, multiplier float64, l1Max int) int
 	return max
 }
 
-func adjustAppAutoMax(appMax, domainMax int, domainActive bool, l1Max int) int {
-	if appMax <= 0 {
-		return 0
-	}
-	if domainActive && appMax <= domainMax {
-		appMax = domainMax + 1
-		if appMax > l1Max {
-			return 0
-		}
-	}
-	return appMax
-}