test: boot a panel on a data directory restored from its own backup (P4)

Restore is not a code path in the panel — the operator extracts the archive
onto /data and starts the image — so it had no test. cmd/panel/restore_test.go
now performs that path in process: download a backup from a running panel
through POST /backup (plain and encrypted), unpack it the way tar -xzf does,
and boot a second panel on the result through run()'s own startup order
(CheckRestore, store.Open, newPanel, Start).

Covered: the restored panel shows the domain and journal the archive carried
and finds the DKIM key, sasldb2 and Postfix sender map where its configuration
says they are; the setup link is not reopened by a restore; a session that
predates the backup still works, as the guide documents; an encrypted download
restores identically; a data directory from another version is refused with
both versions named and the manifest kept for the retry.

serveHTTP is split so the composition it performs (newPanel) can be started
without binding a port. No behaviour change.

Closes the optional P4 item in docs/plans/code-review.md, and with it the
"HandleBackup POST untested" gap from the review's test section. CHANGELOG
updated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

cmd/panel/httpserver.go

@@ -15,17 +15,17 @@ import (
 	"github.com/mixeme/selfpost/internal/web"
 )
 
-// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
-// the database handle shared by all roles: setup, login and the authenticated
-// panel surface (security.md).
-func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
+// newPanel wires the panel's services over the shared database handle and
+// builds the HTTP application from cfg. It is the composition of the panel as
+// the environment describes it, with nothing bound to a port yet.
+func newPanel(cfg config, st *store.Store) (*web.Server, error) {
 	// Applications own the SASL accounts and the Postfix sender map; the domain
 	// service delegates to them when a domain (and its applications) is deleted.
 	pf := postfix.New(cfg.postfixDir)
 	apps := app.NewService(st, app.NewSASLDB(cfg.saslDBPath, cfg.saslRealm), pf)
 	domains := domain.NewService(st, domain.NewOpenDKIM(cfg.opendkimDir), apps, cfg.dkimSelectorDef)
 
-	srvApp, err := web.New(st, domains, apps, web.Config{
+	return web.New(st, domains, apps, web.Config{
 		Hostname:               cfg.hostname,
 		CookieSecure:           cfg.cookieSecure,
 		SubmissionEnabled:      cfg.submissionEnabled,
@@ -42,6 +42,13 @@ func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
 		RateLimitMessagesPerIP: cfg.rateLimitMessagesPerIP,
 		RateLimitWindowSeconds: cfg.rateLimitWindowSeconds,
 	}, cfg.setupTokenPath)
+}
+
+// serveHTTP runs the control-panel HTTP server until ctx is cancelled, using
+// the database handle shared by all roles: setup, login and the authenticated
+// panel surface (security.md).
+func serveHTTP(ctx context.Context, cfg config, st *store.Store) error {
+	srvApp, err := newPanel(cfg, st)
 	if err != nil {
 		return err
 	}