staticcheck: the four items of the audit (stage 0)

- handlers/authz.go: domainIDSet removed, nothing called it (U1000).
- handlers_outbound_pages_test.go: two refusals whose status code was
  assigned and never read (SA4006) now check it is 400 - a custom DMARC
  report mode without an address, export passwords that differ.
- view/pages_test.go: !strings.Contains for a missing box (S1003).
- Audit plan line ticked, roadmap 6/61. No CHANGELOG line: nothing an
  operator sees changes.

staticcheck ./... clean afterwards. Evidence on the test server: see the
previous commit (same tree run).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/authz.go

@@ -57,16 +57,3 @@ func domainNameSet(domains []store.Domain) map[string]bool {
 	}
 	return m
 }
-
-// domainIDSet is the set of sending domains a principal is limited to; nil
-// means no limit (the global role, or a domain user with All).
-func domainIDSet(p auth.Principal) map[int64]bool {
-	if p.IsGlobal() || p.AllDomains {
-		return nil
-	}
-	m := make(map[int64]bool, len(p.Domains))
-	for _, id := range p.Domains {
-		m[id] = true
-	}
-	return m
-}