release: 1.9.0: Per-application client IP allow-list and rate-limit overrides

Application sending controls: client IP allow-list for authorization, and level-2 rate limits that override the domain ceiling per application.
Added:
  - Per-application **client IP allow-list** on the domain page: when enabled,
  - SQLite migration `0009_application_auth_ips.sql` (moves legacy trusted IPs
Changed:
  - Application level-2 rate limit **overrides** the domain limit for that login
  - Domain export/import carries `auth_ip_restrict` / `auth_allowed_ips`; legacy
  - Panel help, Settings, and [guide.md](docs/guide.md) describe override semantics
  - [guide.md](docs/guide.md): full-backup section documents all four capture

Full detail: CHANGELOG.md (1.9.0).

test/e2e/panel_client.go

@@ -195,16 +195,12 @@ func (c *panelClient) addApplication(domainID, login, mode, addresses string) (a
 }
 
 // setRateLimit saves a level-2 limit (guide § Rate limiting) on an application
-// (/applications/{id}/ratelimit). allowedIP is required for the trusted-IP
-// override; domain ceilings are posted without IPs.
-func (c *panelClient) setRateLimit(path, allowedIP string, maxMessages, windowSeconds int) error {
+// or domain (/applications/{id}/ratelimit or /domains/{id}/ratelimit).
+func (c *panelClient) setRateLimit(path string, maxMessages, windowSeconds int) error {
 	vals := url.Values{
 		"max_messages":   {fmt.Sprintf("%d", maxMessages)},
 		"window_seconds": {fmt.Sprintf("%d", windowSeconds)},
 	}
-	if allowedIP != "" {
-		vals.Set("allowed_ips", allowedIP)
-	}
 	resp, body, err := c.postForm(path, vals)
 	if err != nil {
 		return err