panel-redesign: the 2.0 schema from zero - one baseline, no 1.x chain

Stage 1, step 1. BREAKING: a 1.x database is not migrated.

Schema
  - internal/store/migrations/ holds one file, 0001_init.sql, equal to the
    2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
    admin table created and dropped, no ALTERs.
  - users.email replaces users.dmarc_report_email: the address is the
    user's own. The default DMARC report address is a user's setting
    (dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
    the instance setting that mirrored the global user's field is gone.
  - domains.dmarc_rua_user_id: a domain follows a named user's default, or
    has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
    leaves it at "no reports", never at someone else's default.
  - user_inbound_domains, users.all_domains, users.all_inbound_domains: in
    the schema for the inbound delegation of the next step.
  - users.role is 'global' / 'domain' (was 'domain_admin');
    rate_limits.allowed_ips, unused since 1.9.0, is dropped.

Opening a database
  - The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
    file that has a schema version without it (ErrForeignSchema) and one
    newer than the build. A 1.x file at user_version 10 would otherwise read
    as already migrated. The refused file is left untouched.

Code
  - Store.DomainDMARCRua is the one place a domain's report address is
    resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
    gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
    DNS re-check go through it.
  - The old templates keep working on the new model until their pages are
    restyled: the Settings form's address field is the account e-mail and
    switches the user's default between it and none; a domain's "Same as
    Settings" makes it follow the user who chose it; a new or imported
    domain follows its creator.
  - Domain export/import: a domain that follows a user exports no address.

Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.

docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.

go test ./...   (Windows)
  ok for every package except two that fail the same way before this commit:
  internal/domain  TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
  internal/logtail TestFollowTailsAndRotates (rename of an open file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/service.go

@@ -54,10 +54,6 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 	if !s.enabled || s.hostname == "" {
 		return nil, nil
 	}
-	profile, err := s.store.GlobalDMARCReportEmail()
-	if err != nil {
-		return nil, err
-	}
 	seen := make(map[string]bool)
 	var out []string
 	add := func(addr string) {
@@ -68,8 +64,24 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 		seen[addr] = true
 		out = append(out, addr)
 	}
-	add(profile)
-	if profile == "" {
+	// A user's own default that points at this host is accepted even before a
+	// domain follows it, so the address can be published first. With no such
+	// default anywhere, the instance's generic mailbox stays open — the address
+	// the guide tells a fresh install to publish.
+	users, err := s.store.ListUsers()
+	if err != nil {
+		return nil, err
+	}
+	anyDefault := false
+	for _, u := range users {
+		if def := u.DMARCDefault(); def.Mode == store.DMARCDefaultAccount || def.Mode == store.DMARCDefaultCustom {
+			if addr := def.Resolve(""); addr != "" {
+				anyDefault = true
+				add(addr)
+			}
+		}
+	}
+	if !anyDefault {
 		add(DefaultHostedReportAddress(s.hostname))
 	}
 	domains, err := s.store.ListDomains()
@@ -77,21 +89,13 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 		return nil, err
 	}
 	for _, d := range domains {
-		rua := dnscheck.ResolveDMARCRua(d.DMARCRua, profile)
-		if rua == "" {
-			continue
-		}
-		if IsHostedOnHostname(rua, s.hostname) {
-			add(rua)
-			continue
-		}
-		if d.DMARCRua.Valid && d.DMARCRua.String == "" {
-			continue
-		}
-		hosted := HostedReportAddress(s.hostname, d.Name)
-		if strings.EqualFold(rua, hosted) {
-			add(rua)
+		// add keeps only addresses on this host, so a domain reporting elsewhere
+		// (or nowhere) opens nothing here.
+		rua, err := s.store.DomainDMARCRua(d, HostedReportAddress(s.hostname, d.Name))
+		if err != nil {
+			return nil, err
 		}
+		add(rua)
 	}
 	sort.Strings(out)
 	return out, nil