release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/web/view/templates/settings.html

@@ -128,9 +128,10 @@ every other session; this one stays signed in.</p>
   <p class="muted">Optional ceiling for <em>all</em> senders on a domain. When
   unset, only level&nbsp;1 applies. Must be ≤ level&nbsp;1.</p>
 
-  <label>Level 2 — application (trusted IPs)</label>
-  <p class="muted">Optional override: list client IPs and a ceiling
-  <em>strictly above</em> the domain limit (still ≤ level&nbsp;1). Those IPs
-  skip the domain check; everyone else stays under the domain (or level&nbsp;1).</p>
+  <label>Level 2 — application</label>
+  <p class="muted">Overrides the domain limit for one application. The ceiling
+  may be <em>above or below</em> the domain setting (≤ level&nbsp;1). When unset,
+  the domain limit or level&nbsp;1 applies. Independent of the client IP
+  allow-list.</p>
 </div>
 {{end}}