panel-redesign: the 2.0 schema from zero - one baseline, no 1.x chain

Stage 1, step 1. BREAKING: a 1.x database is not migrated.

Schema
  - internal/store/migrations/ holds one file, 0001_init.sql, equal to the
    2.0 schema; 0002..0010 are deleted (they stay in history at 1.9.5). No
    admin table created and dropped, no ALTERs.
  - users.email replaces users.dmarc_report_email: the address is the
    user's own. The default DMARC report address is a user's setting
    (dmarc_default_mode hosted/account/custom/none, dmarc_default_address);
    the instance setting that mirrored the global user's field is gone.
  - domains.dmarc_rua_user_id: a domain follows a named user's default, or
    has an address of its own in dmarc_rua ('' = none). ON DELETE SET NULL
    leaves it at "no reports", never at someone else's default.
  - user_inbound_domains, users.all_domains, users.all_inbound_domains: in
    the schema for the inbound delegation of the next step.
  - users.role is 'global' / 'domain' (was 'domain_admin');
    rate_limits.allowed_ips, unused since 1.9.0, is dropped.

Opening a database
  - The baseline sets PRAGMA application_id ("SP20"). store.Open refuses a
    file that has a schema version without it (ErrForeignSchema) and one
    newer than the build. A 1.x file at user_version 10 would otherwise read
    as already migrated. The refused file is left untouched.

Code
  - Store.DomainDMARCRua is the one place a domain's report address is
    resolved; dnscheck.ResolveDMARCRua and Store.GlobalDMARCReportEmail are
    gone. dmarc.AllowedRecipients, the domain page, the dashboard and the
    DNS re-check go through it.
  - The old templates keep working on the new model until their pages are
    restyled: the Settings form's address field is the account e-mail and
    switches the user's default between it and none; a domain's "Same as
    Settings" makes it follow the user who chose it; a new or imported
    domain follows its creator.
  - Domain export/import: a domain that follows a user exports no address.

Tests: the baseline pinned table by table (TestBaselineSchema), refusal of a
1.x and of a newer database, constraints and cascades of the new columns and
table, resolution in every default mode, the deleted-user case, and the three
bridged handlers.

docs/schema-migrations.md is rewritten for the baseline; roadmap 11/27,
schema-squash marked built.

go test ./...   (Windows)
  ok for every package except two that fail the same way before this commit:
  internal/domain  TestWriteLoadPrivateKeyRoundtrip (file mode on NTFS)
  internal/logtail TestFollowTailsAndRotates (rename of an open file)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_domains.go

@@ -51,10 +51,6 @@ func (h *Handlers) renderDashboard(w http.ResponseWriter, r *http.Request, statu
 }
 
 func (h *Handlers) domainRows(domains []store.Domain) []domainRow {
-	profileEmail := ""
-	if email, err := h.store.GlobalDMARCReportEmail(); err == nil {
-		profileEmail = email
-	}
 	rows := make([]domainRow, len(domains))
 	var wg sync.WaitGroup
 	for i, d := range domains {
@@ -67,7 +63,12 @@ func (h *Handlers) domainRows(domains []store.Domain) []domainRow {
 				logf("panel: dashboard: domain %d: dkim record: %v", d.ID, err)
 				return
 			}
-			dns, _ := h.domainDNS(d, record, profileEmail, false)
+			reportEmail, err := h.domainReportAddress(d)
+			if err != nil {
+				logf("panel: dashboard: domain %d: dmarc report address: %v", d.ID, err)
+				return
+			}
+			dns, _ := h.domainDNS(d, record, reportEmail, false)
 			rows[i].DNS = dns.Overall
 		}()
 	}
@@ -86,7 +87,8 @@ func dashboardFlash(r *http.Request) string {
 // OpenDKIM reload), and redirects to the domain's page so the DNS record to
 // publish is shown (product.md).
 func (h *Handlers) HandleAddDomain(w http.ResponseWriter, r *http.Request) {
-	if _, ok := h.requireGlobal(w, r); !ok {
+	p, ok := h.requireGlobal(w, r)
+	if !ok {
 		return
 	}
 	if err := r.ParseForm(); err != nil {
@@ -111,9 +113,26 @@ func (h *Handlers) HandleAddDomain(w http.ResponseWriter, r *http.Request) {
 			"Could not add the domain. Please check the logs and try again.", raw)
 		return
 	}
+	h.followCreator(d.ID, p.ID)
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d", d.ID), http.StatusSeeOther)
 }
 
+// followCreator makes a new domain take its DMARC report address from the
+// default of whoever created it (plan § Account e-mail). The domain exists
+// either way: a failure here leaves it with no report address, which its page
+// shows and its DMARC form can change.
+func (h *Handlers) followCreator(domainID, userID int64) {
+	if err := h.store.SetDomainDMARCUser(domainID, userID); err != nil {
+		logf("panel: domain %d: follow user %d's dmarc default: %v", domainID, userID, err)
+		return
+	}
+	if h.dmarc != nil && h.dmarc.Enabled() {
+		if err := h.dmarc.Resync(); err != nil {
+			logf("panel: domain %d: dmarc resync: %v", domainID, err)
+		}
+	}
+}
+
 // HandleDeleteConfirm shows the cascade warning before a domain is removed.
 func (h *Handlers) HandleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
 	if _, ok := h.requireGlobal(w, r); !ok {