release: 1.9.2: Review pass: port-25 milters, DMARC validation, rate-limit fix

Review pass over `1.4.0`…`1.9.1`: port 25 no longer shares the submission milter chain, DMARC reports are validated before they are stored, and the auto rate limit is correct for a non-default level-1 window. Schema migration `0010` (index only). Upgrading is a tag bump.
Added:
  - SQLite migration `0010_send_log_app_login_index.sql` —
  - DMARC aggregate reports are accepted as **zip** as well as gzip or plain XML
  - e2e: `checkPort25ConfigCombinations` regenerates the Postfix configuration
Changed:
  - README hero line and a **Positioning** block in `docs/product.md` record the
Fixed:
  - The setup account's password is hashed at bcrypt cost `12` like every other
  - Login/setup rate limiter: protecting blocked buckets from eviction is now
  - `postqueue -p` output is bounded to 4 MiB (the timeout alone left the size of
  - [schema-migrations.md](docs/schema-migrations.md): the schema section was
  - postqueue reader is now time-bounded: `postqueue -p` runs under a 5-second
  … (11 more in CHANGELOG)
Changed:
  - [roadmap.md](docs/roadmap.md) now carries everything the 2026-08-19 code
  - Extracted `internal/configsafe` — the empty-value and forbidden-character
  - Build, deploy and migration comments no longer cite the archived
  - Dropped the `parseDomainRateLimitForm` / `parseAppRateLimitForm` pass-through
  - Extracted shared helpers: `internal/atomicfile` (atomic temp-write+rename) and
  … (7 more in CHANGELOG)
Removed:
  - Unused legacy asset `docs/assets/icon.png` (superseded by the four brand SVGs
  - Plan documents for already-shipped features: `domain-stats-auto-ratelimit`,

Full detail: CHANGELOG.md (1.9.2).

internal/dmarc/parse.go

@@ -1,6 +1,7 @@
 package dmarc
 
 import (
+	"archive/zip"
 	"bytes"
 	"compress/gzip"
 	"encoding/xml"
@@ -73,9 +74,9 @@ type feedbackXML struct {
 	} `xml:"record"`
 }
 
-// ParseAggregate decodes gzip-compressed or raw DMARC aggregate XML.
+// ParseAggregate decodes gzip- or zip-compressed, or raw, DMARC aggregate XML.
 func ParseAggregate(raw []byte) (ParsedReport, error) {
-	data, err := maybeGunzip(raw)
+	data, err := decompress(raw)
 	if err != nil {
 		return ParsedReport{}, err
 	}
@@ -128,20 +129,59 @@ func dmarcRecordPasses(r ParsedRecord) bool {
 	return strings.EqualFold(r.SPFResult, "pass") || strings.EqualFold(r.DKIMResult, "pass")
 }
 
-func maybeGunzip(raw []byte) ([]byte, error) {
-	if len(raw) >= 2 && raw[0] == 0x1f && raw[1] == 0x8b {
-		zr, err := gzip.NewReader(bytes.NewReader(raw))
-		if err != nil {
-			return nil, fmt.Errorf("dmarc gzip: %w", err)
+// maxAggregateXML bounds the decompressed payload, so a small archive cannot
+// expand into an unbounded allocation.
+const maxAggregateXML = 8 << 20
+
+// decompress unwraps the container the reporter used. Both are seen in the
+// wild: most senders gzip the XML, some (notably several Microsoft and Yahoo
+// endpoints) ship it as a single-entry zip.
+func decompress(raw []byte) ([]byte, error) {
+	switch {
+	case len(raw) >= 2 && raw[0] == 0x1f && raw[1] == 0x8b:
+		return gunzip(raw)
+	case len(raw) >= 4 && raw[0] == 'P' && raw[1] == 'K' && raw[2] == 0x03 && raw[3] == 0x04:
+		return unzip(raw)
+	}
+	return raw, nil
+}
+
+func gunzip(raw []byte) ([]byte, error) {
+	zr, err := gzip.NewReader(bytes.NewReader(raw))
+	if err != nil {
+		return nil, fmt.Errorf("dmarc gzip: %w", err)
+	}
+	defer zr.Close()
+	data, err := io.ReadAll(io.LimitReader(zr, maxAggregateXML))
+	if err != nil {
+		return nil, fmt.Errorf("dmarc gzip read: %w", err)
+	}
+	return data, nil
+}
+
+// unzip returns the first .xml entry of a zip archive. Directories and any
+// other members are skipped rather than trusted.
+func unzip(raw []byte) ([]byte, error) {
+	zr, err := zip.NewReader(bytes.NewReader(raw), int64(len(raw)))
+	if err != nil {
+		return nil, fmt.Errorf("dmarc zip: %w", err)
+	}
+	for _, f := range zr.File {
+		if f.FileInfo().IsDir() || !strings.HasSuffix(strings.ToLower(f.Name), ".xml") {
+			continue
 		}
-		defer zr.Close()
-		data, err := io.ReadAll(io.LimitReader(zr, 8<<20))
+		rc, err := f.Open()
 		if err != nil {
-			return nil, fmt.Errorf("dmarc gzip read: %w", err)
+			return nil, fmt.Errorf("dmarc zip open %s: %w", f.Name, err)
+		}
+		data, err := io.ReadAll(io.LimitReader(rc, maxAggregateXML))
+		rc.Close()
+		if err != nil {
+			return nil, fmt.Errorf("dmarc zip read %s: %w", f.Name, err)
 		}
 		return data, nil
 	}
-	return raw, nil
+	return nil, fmt.Errorf("dmarc zip: no xml entry")
 }
 
 // TightenPolicyHint summarises whether raising p= looks reasonable.