staticcheck: the four items of the audit (stage 0)

- handlers/authz.go: domainIDSet removed, nothing called it (U1000).
- handlers_outbound_pages_test.go: two refusals whose status code was
  assigned and never read (SA4006) now check it is 400 - a custom DMARC
  report mode without an address, export passwords that differ.
- view/pages_test.go: !strings.Contains for a missing box (S1003).
- Audit plan line ticked, roadmap 6/61. No CHANGELOG line: nothing an
  operator sees changes.

staticcheck ./... clean afterwards. Evidence on the test server: see the
previous commit (same tree run).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -562,7 +562,7 @@ has already run is never edited — the next file is added; the published
 - [x] **Toolchain and deps**: `modernc.org/sqlite`, `x/crypto`, `x/sys`; note in
    development.md that the image is rebuilt after each Go patch release
    (`golang:1.26-bookworm` floats, so a rebuild suffices). — **Haiku**
-- [ ] The four `staticcheck` items. — **Haiku**
+- [x] The four `staticcheck` items. — **Haiku**
 - [ ] **A negative e2e case passes only on the refusal it is about** (owner,
    2026-10-14; seen, not found by the audit). `negative_level1_ratelimit`
    sends up to sixty messages and waits for one to be refused; it once