panel-redesign: the 2.0 schema from zero - one baseline, no 1.x chain

Stage 1, step 1. BREAKING: a 1.x database is not migrated.

Schema
  - internal/store/migrations/ holds one file, 0001_init.sql, equal to the
    2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
    admin table created and dropped, no ALTERs.
  - users.email replaces users.dmarc_report_email: the address is the
    user's own. The default DMARC report address is a user's setting
    (dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
    the instance setting that mirrored the global user's field is gone.
  - domains.dmarc_rua_user_id: a domain follows a named user's default, or
    has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
    leaves it at "no reports", never at someone else's default.
  - user_inbound_domains, users.all_domains, users.all_inbound_domains: in
    the schema for the inbound delegation of the next step.
  - users.role is 'global' / 'domain' (was 'domain_admin');
    rate_limits.allowed_ips, unused since 1.9.0, is dropped.

Opening a database
  - The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
    file that has a schema version without it (ErrForeignSchema) and one
    newer than the build. A 1.x file at user_version 10 would otherwise read
    as already migrated. The refused file is left untouched.

Code
  - Store.DomainDMARCRua is the one place a domain's report address is
    resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
    gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
    DNS re-check go through it.
  - The old templates keep working on the new model until their pages are
    restyled: the Settings form's address field is the account e-mail and
    switches the user's default between it and none; a domain's "Same as
    Settings" makes it follow the user who chose it; a new or imported
    domain follows its creator.
  - Domain export/import: a domain that follows a user exports no address.

Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.

docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.

go test ./...   (Windows)
  ok for every package except two that fail the same way before this commit:
  internal/domain  TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
  internal/logtail TestFollowTailsAndRotates (rename of an open file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -29,8 +29,28 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   mockups too, and its button takes the same hover, focus and press tint as
   Account and Help (owner, 2026-10-09).
 
+- panel-redesign (stage 1): the 2.0 schema. `users.email` is the user's own
+  address; the default DMARC report address is a user's setting
+  (`dmarc_default_mode` / `dmarc_default_address`) and a domain either has an
+  address of its own or follows a named user's default
+  (`domains.dmarc_rua_user_id`) — a new domain follows whoever created it,
+  and deleting that user leaves it with no report address.
+  `user_inbound_domains` and the per-user `all_domains` /
+  `all_inbound_domains` flags are in the schema for the inbound delegation
+  that follows. Details: `docs/schema-migrations.md`.
+
 ### Changed
 
+- **Breaking — the database starts from zero.** The 1.x migration chain
+  (`0001`–`0010`) is replaced by one baseline, `0001_init.sql`. A 1.x
+  `/data/selfpost.db` is refused at start-up with an explicit error and left
+  untouched; nothing is migrated. A domain can be carried over with its
+  export file.
+- The panel role `domain_admin` is stored as `domain`.
+- Until the Account page replaces it, the old Settings form's "default report
+  address" field sets the account e-mail and switches the user's DMARC
+  default between that e-mail and none; a domain's "Same as Settings" makes
+  it follow the user who chose it.
 - The old panel is untouched on screen but steps aside in the tree: its
   stylesheet is `legacy.css` and its layout `layout_legacy.html` until the
   last old page is restyled. The 2.0 menu paths in the new shell do not
@@ -38,6 +58,11 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 - panel-redesign is `agreed` (owner, 2026-10-09); work starts with stage 0,
   the component kit.
 
+### Removed
+
+- The instance setting `dmarc_report_email` (a mirror of the global user's
+  profile field) and the unused `rate_limits.allowed_ips` column.
+
 ## [1.9.5] - 2026-10-09
 
 CI-only cut: the release workflow no longer breaks the multi-arch image it