staticcheck: the four items of the audit (stage 0)

- handlers/authz.go: domainIDSet removed, nothing called it (U1000).
- handlers_outbound_pages_test.go: two refusals whose status code was
  assigned and never read (SA4006) now check it is 400 - a custom DMARC
  report mode without an address, export passwords that differ.
- view/pages_test.go: !strings.Contains for a missing box (S1003).
- Audit plan line ticked, roadmap 6/61. No CHANGELOG line: nothing an
  operator sees changes.

staticcheck ./... clean afterwards. Evidence on the test server: see the
previous commit (same tree run).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/pages_test.go

@@ -167,7 +167,7 @@ func TestHealthShowsEveryCheckAndBothActions(t *testing.T) {
 	order := []string{`id="processes"`, `id="sender-check"`, `id="hostname"`, `id="machine"`,
 		`id="sockets"`, `id="certificate"`, `id="notification-mail"`, `id="configuration"`}
 	for i := 1; i < len(order); i++ {
-		if strings.Index(out, order[i-1]) < 0 || strings.Index(out, order[i]) < strings.Index(out, order[i-1]) {
+		if !strings.Contains(out, order[i-1]) || strings.Index(out, order[i]) < strings.Index(out, order[i-1]) {
 			t.Errorf("%s does not come after %s", order[i], order[i-1])
 		}
 	}