panel-redesign: the 2.0 schema from zero - one baseline, no 1.x chain

Stage 1, step 1. BREAKING: a 1.x database is not migrated.

Schema
  - internal/store/migrations/ holds one file, 0001_init.sql, equal to the
    2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
    admin table created and dropped, no ALTERs.
  - users.email replaces users.dmarc_report_email: the address is the
    user's own. The default DMARC report address is a user's setting
    (dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
    the instance setting that mirrored the global user's field is gone.
  - domains.dmarc_rua_user_id: a domain follows a named user's default, or
    has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
    leaves it at "no reports", never at someone else's default.
  - user_inbound_domains, users.all_domains, users.all_inbound_domains: in
    the schema for the inbound delegation of the next step.
  - users.role is 'global' / 'domain' (was 'domain_admin');
    rate_limits.allowed_ips, unused since 1.9.0, is dropped.

Opening a database
  - The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
    file that has a schema version without it (ErrForeignSchema) and one
    newer than the build. A 1.x file at user_version 10 would otherwise read
    as already migrated. The refused file is left untouched.

Code
  - Store.DomainDMARCRua is the one place a domain's report address is
    resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
    gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
    DNS re-check go through it.
  - The old templates keep working on the new model until their pages are
    restyled: the Settings form's address field is the account e-mail and
    switches the user's default between it and none; a domain's "Same as
    Settings" makes it follow the user who chose it; a new or imported
    domain follows its creator.
  - Domain export/import: a domain that follows a user exports no address.

Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.

docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.

go test ./...   (Windows)
  ok for every package except two that fail the same way before this commit:
  internal/domain  TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
  internal/logtail TestFollowTailsAndRotates (rename of an open file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/service.go

@@ -146,11 +146,9 @@ func (s *Service) RateLimit(domainID int64) (store.RateLimit, bool, error) {
 
 // SaveRateLimit stores the domain-level rate limit. The caller has validated the
 // numbers (security.md); the milter reads the row live, so no reload is needed.
-// Domain limits do not use an IP allowlist.
 func (s *Service) SaveRateLimit(domainID int64, rl store.RateLimit) error {
 	rl.Scope = store.RateLimitScopeDomain
 	rl.RefID = domainID
-	rl.AllowedIPs = nil
 	return s.store.SetRateLimit(rl)
 }
 

internal/domain/transfer.go

@@ -1,7 +1,6 @@
 package domain
 
 import (
-	"database/sql"
 	"fmt"
 
 	"github.com/mixeme/selfpost/internal/buildinfo"
@@ -24,7 +23,7 @@ type DomainExport struct {
 	Domain         string           `json:"domain"`
 	DKIMSelector   string           `json:"dkim_selector"`
 	DKIMPrivateKey string           `json:"dkim_private_key"`    // PKCS#1 PEM
-	DMARCRua       *string          `json:"dmarc_rua,omitempty"` // nil = inherit profile; set = override ("" = none)
+	DMARCRua       *string          `json:"dmarc_rua,omitempty"` // nil = follows a user's default; set = the domain's own address ("" = none)
 	RateLimit      *RateLimitExport `json:"rate_limit,omitempty"`
 	Applications   []AppExport      `json:"applications"`
 }
@@ -74,9 +73,11 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 		DKIMPrivateKey: string(pem),
 		Applications:   make([]AppExport, 0, len(apps)),
 	}
-	if d.DMARCRua.Valid {
-		s := d.DMARCRua.String
-		exp.DMARCRua = &s
+	// A domain that follows a user's default exports no address: users do not
+	// travel with a domain, and whoever imports it becomes the one it follows.
+	if !d.DMARCRuaUserID.Valid {
+		rua := d.DMARCRua
+		exp.DMARCRua = &rua
 	}
 	rl, ok, err := s.store.GetRateLimit(store.RateLimitScopeDomain, id)
 	if err != nil {
@@ -147,11 +148,11 @@ func (s *Service) Import(exp DomainExport) (store.Domain, error) {
 	}
 
 	if exp.DMARCRua != nil {
-		if err := s.store.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: *exp.DMARCRua}); err != nil {
+		if err := s.store.SetDomainDMARCAddress(d.ID, *exp.DMARCRua); err != nil {
 			s.importRollback(d.ID)
 			return store.Domain{}, err
 		}
-		d.DMARCRua = sql.NullString{Valid: true, String: *exp.DMARCRua}
+		d.DMARCRua = *exp.DMARCRua
 	}
 	if exp.RateLimit != nil {
 		if err := s.importRateLimit(store.RateLimitScopeDomain, d.ID, *exp.RateLimit); err != nil {

internal/domain/transfer_test.go

@@ -1,7 +1,6 @@
 package domain
 
 import (
-	"database/sql"
 	"errors"
 	"fmt"
 	"testing"
@@ -73,7 +72,7 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if _, err := src.store.AddApplication(d.ID, "alerts", store.AddressModeList, []string{"a@example.com"}); err != nil {
 		t.Fatalf("add alerts: %v", err)
 	}
-	if err := src.store.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: "reports@hub.example"}); err != nil {
+	if err := src.store.SetDomainDMARCAddress(d.ID, "reports@hub.example"); err != nil {
 		t.Fatalf("set dmarc rua: %v", err)
 	}
 
@@ -111,8 +110,8 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if got.Name != "example.com" || got.DKIMSelector != "selfpost" {
 		t.Errorf("imported domain = %+v", got)
 	}
-	if !got.DMARCRua.Valid || got.DMARCRua.String != "reports@hub.example" {
-		t.Errorf("imported dmarc rua = %+v", got.DMARCRua)
+	if got.DMARCRuaUserID.Valid || got.DMARCRua != "reports@hub.example" {
+		t.Errorf("imported dmarc rua = %q (follows user: %v)", got.DMARCRua, got.DMARCRuaUserID.Valid)
 	}
 	if exp.DMARCRua == nil || *exp.DMARCRua != "reports@hub.example" {
 		t.Errorf("exported dmarc rua = %v", exp.DMARCRua)