phase1-3: apply review fixes and docs alignment

Implement phase 1 and 2 review actions (DMARC UI CSS fixes, bounded DMARC ingest stdin,
rate-limit eviction hardening, settings/user handler cleanup, shared atomic/supervisor helpers)
and phase 3 documentation/changelog updates including roadmap and accepted-risk notes.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/roadmap.md

@@ -69,8 +69,9 @@ priority.
 
 ## panel-docs
 
-**Status:** done — shipped in `[1.8.0]` (2026-08-18). Plan:
-[plans/panel-docs.md](plans/panel-docs.md) (checklist complete).
+**Status:** done — shipped in `[1.8.0]` (2026-08-18). The implementation plan
+file was removed as shipped cleanup; release details remain in
+[CHANGELOG.md](../CHANGELOG.md).
 
 **Goal:** built-in operator documentation in the panel — short pages (or a
 help drawer) that explain what each Status check and other controls mean,

docs/security.md

@@ -204,6 +204,15 @@ deferred item from the roadmap.
   the journal from recording sends at all. The trigger to revisit is a
   requirement for the allow-list to hold as a security boundary — at which
   point it must move to the SASL/smtpd layer and fail closed.
+- **Level-2 in-flight reservations can outlive a dropped SMTP session until TTL.**
+  The journal milter cannot observe connection-close directly through
+  go-milter, so if a client disconnects without an explicit `Abort`, its
+  in-memory reservation is released by TTL expiry, not immediately. The map is
+  bounded by key and TTL (currently 10 minutes), so the effect is temporary
+  over-counting on that app/domain key under churn. Accepted deliberately:
+  immediate cleanup would require protocol hooks the current milter interface
+  does not expose; the TTL bound keeps it finite. Trigger to revisit: sustained
+  high-volume false throttling attributable to orphaned reservations.
 - **Access to `mail.log` from the unprivileged panel.** The `/data/log`
   directory is `2750 postfix:selfpost` and the file is `0640`: `postlogd` (user
   `postfix`) writes, the panel reads through the shared `selfpost` group, and