panel-redesign: the 2.0 schema from zero - one baseline, no 1.x chain

Stage 1, step 1. BREAKING: a 1.x database is not migrated.

Schema
  - internal/store/migrations/ holds one file, 0001_init.sql, equal to the
    2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
    admin table created and dropped, no ALTERs.
  - users.email replaces users.dmarc_report_email: the address is the
    user's own. The default DMARC report address is a user's setting
    (dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
    the instance setting that mirrored the global user's field is gone.
  - domains.dmarc_rua_user_id: a domain follows a named user's default, or
    has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
    leaves it at "no reports", never at someone else's default.
  - user_inbound_domains, users.all_domains, users.all_inbound_domains: in
    the schema for the inbound delegation of the next step.
  - users.role is 'global' / 'domain' (was 'domain_admin');
    rate_limits.allowed_ips, unused since 1.9.0, is dropped.

Opening a database
  - The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
    file that has a schema version without it (ErrForeignSchema) and one
    newer than the build. A 1.x file at user_version 10 would otherwise read
    as already migrated. The refused file is left untouched.

Code
  - Store.DomainDMARCRua is the one place a domain's report address is
    resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
    gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
    DNS re-check go through it.
  - The old templates keep working on the new model until their pages are
    restyled: the Settings form's address field is the account e-mail and
    switches the user's default between it and none; a domain's "Same as
    Settings" makes it follow the user who chose it; a new or imported
    domain follows its creator.
  - Domain export/import: a domain that follows a user exports no address.

Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.

docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.

go test ./...   (Windows)
  ok for every package except two that fail the same way before this commit:
  internal/domain  TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
  internal/logtail TestFollowTailsAndRotates (rename of an open file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/users.go

@@ -22,20 +22,95 @@ var ErrLastGlobal = errors.New("cannot remove last global administrator")
 // Role identifies a panel user's access level.
 type Role string
 
+// The role is a reach, not a rank: everyone in the panel is an administrator,
+// of the whole instance or of the domains assigned to them.
 const (
-	RoleGlobal      Role = "global"
-	RoleDomainAdmin Role = "domain_admin"
+	RoleGlobal Role = "global"
+	RoleDomain Role = "domain"
 )
 
+// How a user's default DMARC report address is chosen (users.dmarc_default_mode).
+const (
+	DMARCDefaultHosted  = "hosted"  // SelfPost's own mailbox for the domain
+	DMARCDefaultAccount = "account" // the user's account e-mail
+	DMARCDefaultCustom  = "custom"  // DMARCDefault.Address
+	DMARCDefaultNone    = "none"    // no aggregate reports
+)
+
+// DMARCDefault is a user's default report address: the choice a domain takes
+// over when it follows that user (Domain.DMARCRuaUserID).
+type DMARCDefault struct {
+	UserID   int64
+	Username string
+	Mode     string
+	Address  string // for DMARCDefaultCustom
+	Email    string // the account e-mail, for DMARCDefaultAccount
+}
+
+// Resolve returns the address the default stands for on one domain. hosted is
+// the SelfPost-hosted mailbox for that domain, "" when report ingest is off —
+// a hosted default then resolves to no reports.
+func (d DMARCDefault) Resolve(hosted string) string {
+	switch d.Mode {
+	case DMARCDefaultHosted:
+		return hosted
+	case DMARCDefaultAccount:
+		return d.Email
+	case DMARCDefaultCustom:
+		return d.Address
+	}
+	return ""
+}
+
+// ValidDMARCDefaultMode reports whether mode is one of the stored choices.
+func ValidDMARCDefaultMode(mode string) bool {
+	switch mode {
+	case DMARCDefaultHosted, DMARCDefaultAccount, DMARCDefaultCustom, DMARCDefaultNone:
+		return true
+	}
+	return false
+}
+
 // User is a panel login (not an application SASL account).
 type User struct {
-	ID               int64
-	Username         string
-	PasswordHash     string
-	Role             Role
-	DMARCReportEmail string
-	CreatedAt        time.Time
-	DomainIDs        []int64
+	ID           int64
+	Username     string
+	PasswordHash string
+	Role         Role
+	// Email is the user's own address — what the panel writes to. DMARC may
+	// use it (DMARCDefaultAccount) but it is not a DMARC field.
+	Email               string
+	DMARCDefaultMode    string
+	DMARCDefaultAddress string
+	// AllDomains / AllInboundDomains widen a domain user's list to every
+	// domain of that direction, including those added later; the id lists
+	// are then ignored.
+	AllDomains        bool
+	AllInboundDomains bool
+	CreatedAt         time.Time
+	DomainIDs         []int64
+	InboundDomainIDs  []int64
+}
+
+// DMARCDefault returns the user's default report address choice.
+func (u User) DMARCDefault() DMARCDefault {
+	return DMARCDefault{UserID: u.ID, Username: u.Username, Mode: u.DMARCDefaultMode, Address: u.DMARCDefaultAddress, Email: u.Email}
+}
+
+const userColumns = "id, username, password_hash, role, email, dmarc_default_mode, dmarc_default_address, all_domains, all_inbound_domains, created_at"
+
+func scanUser(r scanRow) (User, error) {
+	var (
+		u         User
+		createdAt string
+	)
+	err := r.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.Email, &u.DMARCDefaultMode, &u.DMARCDefaultAddress,
+		&u.AllDomains, &u.AllInboundDomains, &createdAt)
+	if err != nil {
+		return User{}, err
+	}
+	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
+	return u, nil
 }
 
 // UserExists reports whether any panel user exists (setup complete).
@@ -58,7 +133,7 @@ func (s *Store) CreateGlobalUser(username, passwordHash string) error {
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	_, err = s.db.Exec(
-		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		"INSERT INTO users (username, password_hash, role, created_at) VALUES (?, ?, ?, ?)",
 		username, passwordHash, RoleGlobal, now,
 	)
 	if err != nil {
@@ -69,23 +144,17 @@ func (s *Store) CreateGlobalUser(username, passwordHash string) error {
 
 // GetUserByUsername returns a user with domain assignments loaded.
 func (s *Store) GetUserByUsername(username string) (User, error) {
-	var (
-		u         User
-		createdAt string
-	)
-	err := s.db.QueryRow(
-		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE username = ?",
-		username,
-	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	u, err := scanUser(s.db.QueryRow("SELECT "+userColumns+" FROM users WHERE username = ?", username))
 	if errors.Is(err, sql.ErrNoRows) {
 		return User{}, ErrUserNotFound
 	}
 	if err != nil {
 		return User{}, fmt.Errorf("get user by username: %w", err)
 	}
-	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
-	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
-	if err != nil {
+	if u.DomainIDs, err = s.listUserDomainIDs(u.ID); err != nil {
+		return User{}, err
+	}
+	if u.InboundDomainIDs, err = s.listUserInboundDomainIDs(u.ID); err != nil {
 		return User{}, err
 	}
 	return u, nil
@@ -93,47 +162,35 @@ func (s *Store) GetUserByUsername(username string) (User, error) {
 
 // GetUser returns a user by id with domain assignments.
 func (s *Store) GetUser(id int64) (User, error) {
-	var (
-		u         User
-		createdAt string
-	)
-	err := s.db.QueryRow(
-		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users WHERE id = ?",
-		id,
-	).Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt)
+	u, err := scanUser(s.db.QueryRow("SELECT "+userColumns+" FROM users WHERE id = ?", id))
 	if errors.Is(err, sql.ErrNoRows) {
 		return User{}, ErrUserNotFound
 	}
 	if err != nil {
 		return User{}, fmt.Errorf("get user: %w", err)
 	}
-	u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
-	u.DomainIDs, err = s.listUserDomainIDs(u.ID)
-	if err != nil {
+	if u.DomainIDs, err = s.listUserDomainIDs(u.ID); err != nil {
+		return User{}, err
+	}
+	if u.InboundDomainIDs, err = s.listUserInboundDomainIDs(u.ID); err != nil {
 		return User{}, err
 	}
 	return u, nil
 }
 
-// ListUsers returns every panel user without domain ids.
+// ListUsers returns every panel user without the assigned domain ids.
 func (s *Store) ListUsers() ([]User, error) {
-	rows, err := s.db.Query(
-		"SELECT id, username, password_hash, role, dmarc_report_email, created_at FROM users ORDER BY id",
-	)
+	rows, err := s.db.Query("SELECT " + userColumns + " FROM users ORDER BY id")
 	if err != nil {
 		return nil, fmt.Errorf("list users: %w", err)
 	}
 	defer rows.Close()
 	var users []User
 	for rows.Next() {
-		var (
-			u         User
-			createdAt string
-		)
-		if err := rows.Scan(&u.ID, &u.Username, &u.PasswordHash, &u.Role, &u.DMARCReportEmail, &createdAt); err != nil {
+		u, err := scanUser(rows)
+		if err != nil {
 			return nil, fmt.Errorf("list users scan: %w", err)
 		}
-		u.CreatedAt, _ = time.Parse(time.RFC3339, createdAt)
 		users = append(users, u)
 	}
 	return users, rows.Err()
@@ -177,12 +234,12 @@ func (s *Store) CountGlobalUsers() (int, error) {
 
 // CreateUser inserts a panel user and optional domain assignments.
 func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs []int64) (int64, error) {
-	if role == RoleDomainAdmin && len(domainIDs) == 0 {
-		return 0, fmt.Errorf("create user: domain_admin requires domains")
+	if role == RoleDomain && len(domainIDs) == 0 {
+		return 0, fmt.Errorf("create user: the domain role requires domains")
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 	res, err := s.db.Exec(
-		"INSERT INTO users (username, password_hash, role, dmarc_report_email, created_at) VALUES (?, ?, ?, '', ?)",
+		"INSERT INTO users (username, password_hash, role, created_at) VALUES (?, ?, ?, ?)",
 		username, passwordHash, role, now,
 	)
 	if err != nil {
@@ -195,7 +252,7 @@ func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs [
 	if err != nil {
 		return 0, fmt.Errorf("create user id: %w", err)
 	}
-	if role == RoleDomainAdmin {
+	if role == RoleDomain {
 		if err := s.setUserDomains(id, domainIDs); err != nil {
 			return 0, err
 		}
@@ -203,15 +260,11 @@ func (s *Store) CreateUser(username, passwordHash string, role Role, domainIDs [
 	return id, nil
 }
 
-// UpdateUser replaces username, password hash, and DMARC email for a user.
-func (s *Store) UpdateUser(id int64, username, passwordHash, dmarcReportEmail string) error {
-	u, err := s.GetUser(id)
-	if err != nil {
-		return err
-	}
+// UpdateUser replaces a user's username, password hash and account e-mail.
+func (s *Store) UpdateUser(id int64, username, passwordHash, email string) error {
 	res, err := s.db.Exec(
-		"UPDATE users SET username = ?, password_hash = ?, dmarc_report_email = ? WHERE id = ?",
-		username, passwordHash, dmarcReportEmail, id,
+		"UPDATE users SET username = ?, password_hash = ?, email = ? WHERE id = ?",
+		username, passwordHash, email, id,
 	)
 	if err != nil {
 		if isUniqueViolation(err) {
@@ -226,14 +279,50 @@ func (s *Store) UpdateUser(id int64, username, passwordHash, dmarcReportEmail st
 	if n == 0 {
 		return ErrUserNotFound
 	}
-	if u.Role == RoleGlobal {
-		if err := s.SetSetting("dmarc_report_email", dmarcReportEmail); err != nil {
-			return err
-		}
+	return nil
+}
+
+// SetDMARCDefault stores the user's default report address choice. address is
+// kept only for DMARCDefaultCustom. Every domain that follows this user
+// resolves to the new choice from the next read on.
+func (s *Store) SetDMARCDefault(userID int64, mode, address string) error {
+	if !ValidDMARCDefaultMode(mode) {
+		return fmt.Errorf("set dmarc default: unknown mode %q", mode)
+	}
+	if mode != DMARCDefaultCustom {
+		address = ""
+	}
+	res, err := s.db.Exec(
+		"UPDATE users SET dmarc_default_mode = ?, dmarc_default_address = ? WHERE id = ?", mode, address, userID)
+	if err != nil {
+		return fmt.Errorf("set dmarc default: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("set dmarc default: %w", err)
+	}
+	if n == 0 {
+		return ErrUserNotFound
 	}
 	return nil
 }
 
+// GetDMARCDefault returns a user's default report address choice, or
+// ErrUserNotFound.
+func (s *Store) GetDMARCDefault(userID int64) (DMARCDefault, error) {
+	d := DMARCDefault{UserID: userID}
+	err := s.db.QueryRow(
+		"SELECT username, dmarc_default_mode, dmarc_default_address, email FROM users WHERE id = ?", userID,
+	).Scan(&d.Username, &d.Mode, &d.Address, &d.Email)
+	if errors.Is(err, sql.ErrNoRows) {
+		return DMARCDefault{}, ErrUserNotFound
+	}
+	if err != nil {
+		return DMARCDefault{}, fmt.Errorf("get dmarc default: %w", err)
+	}
+	return d, nil
+}
+
 // SetUserRole updates a user's role.
 func (s *Store) SetUserRole(userID int64, role Role) error {
 	res, err := s.db.Exec("UPDATE users SET role = ? WHERE id = ?", role, userID)
@@ -259,14 +348,14 @@ func (s *Store) ClearUserDomains(userID int64) error {
 	return nil
 }
 
-// SetUserDomains replaces domain assignments for a domain_admin user.
+// SetUserDomains replaces the outbound domain assignments of a domain user.
 func (s *Store) SetUserDomains(userID int64, domainIDs []int64) error {
 	u, err := s.GetUser(userID)
 	if err != nil {
 		return err
 	}
-	if u.Role != RoleDomainAdmin {
-		return fmt.Errorf("set user domains: user is not domain_admin")
+	if u.Role != RoleDomain {
+		return fmt.Errorf("set user domains: user does not have the domain role")
 	}
 	if len(domainIDs) == 0 {
 		return fmt.Errorf("set user domains: at least one domain required")
@@ -303,9 +392,22 @@ func (s *Store) DeleteUser(id int64) error {
 	return nil
 }
 
-// GlobalDMARCReportEmail returns the shared default rua= for domain inherit mode.
-func (s *Store) GlobalDMARCReportEmail() (string, error) {
-	return s.GetSetting("dmarc_report_email")
+func (s *Store) listUserInboundDomainIDs(userID int64) ([]int64, error) {
+	rows, err := s.db.Query(
+		"SELECT inbound_domain_id FROM user_inbound_domains WHERE user_id = ? ORDER BY inbound_domain_id", userID)
+	if err != nil {
+		return nil, fmt.Errorf("list user inbound domains: %w", err)
+	}
+	defer rows.Close()
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("list user inbound domains scan: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
 }
 
 func (s *Store) listUserDomainIDs(userID int64) ([]int64, error) {