release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

internal/web/view/templates_test.go

@@ -283,8 +283,8 @@ func TestDomainDetailPageHasPairedCards(t *testing.T) {
 	if !strings.Contains(src, "Level 1 backstop") {
 		t.Error("domain rate limit should show a Level 1 backstop line")
 	}
-	if !strings.Contains(src, "Trusted client IPs") {
-		t.Error("application override should ask for trusted client IPs")
+	if !strings.Contains(src, "Restrict to listed IPs") {
+		t.Error("application should offer client IP allow-list")
 	}
 	if strings.Contains(src, `id="spf-dmarc"`) {
 		t.Error("SPF should sit with DKIM, not with DMARC")
@@ -306,7 +306,7 @@ func TestSettingsPageDocumentsRateLimits(t *testing.T) {
 	for _, want := range []string{
 		"RATE_LIMIT_MESSAGES_PER_IP",
 		"Level 2 — domain",
-		"trusted IPs",
+		"Level 2 — application",
 		"{{.L1Messages}} messages / {{.L1Window}} seconds",
 		`name="send_log_retention_days"`,
 	} {