panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/service.go

@@ -64,26 +64,10 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 		seen[addr] = true
 		out = append(out, addr)
 	}
-	// A user's own default that points at this host is accepted even before a
-	// domain follows it, so the address can be published first. With no such
-	// default anywhere, the instance's generic mailbox stays open — the address
-	// the guide tells a fresh install to publish.
-	users, err := s.store.ListUsers()
-	if err != nil {
-		return nil, err
-	}
-	anyDefault := false
-	for _, u := range users {
-		if def := u.DMARCDefault(); def.Mode == store.DMARCDefaultAccount || def.Mode == store.DMARCDefaultCustom {
-			if addr := def.Resolve(""); addr != "" {
-				anyDefault = true
-				add(addr)
-			}
-		}
-	}
-	if !anyDefault {
-		add(DefaultHostedReportAddress(s.hostname))
-	}
+	// The instance's generic mailbox is always open: it is the address the
+	// guide tells a fresh install to publish. A domain's own report address
+	// opens the mailbox it names, if that is on this host.
+	add(DefaultHostedReportAddress(s.hostname))
 	domains, err := s.store.ListDomains()
 	if err != nil {
 		return nil, err
@@ -91,11 +75,7 @@ func (s *Service) AllowedRecipients() ([]string, error) {
 	for _, d := range domains {
 		// add keeps only addresses on this host, so a domain reporting elsewhere
 		// (or nowhere) opens nothing here.
-		rua, err := s.store.DomainDMARCRua(d, HostedReportAddress(s.hostname, d.Name))
-		if err != nil {
-			return nil, err
-		}
-		add(rua)
+		add(d.DMARCRua)
 	}
 	sort.Strings(out)
 	return out, nil

internal/dmarc/service_test.go

@@ -0,0 +1,43 @@
+package dmarc
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// The ingest allow-list is the generic mailbox plus the report address of each
+// domain that points at this host: a new domain (no reports) and a domain
+// reporting to another host open nothing of their own.
+func TestAllowedRecipientsFollowTheDomainAddresses(t *testing.T) {
+	st, err := store.Open(t.TempDir() + "/test.db")
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer st.Close()
+	hosted, _ := st.AddDomain("hosted.example", "sel")
+	typed, _ := st.AddDomain("typed.example", "sel")
+	if _, err := st.AddDomain("silent.example", "sel"); err != nil {
+		t.Fatalf("AddDomain: %v", err)
+	}
+	local, _ := st.AddDomain("local.example", "sel")
+	if err := st.SetDomainDMARCAddress(hosted.ID, HostedReportAddress("mail.example.com", "hosted.example")); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SetDomainDMARCAddress(typed.ID, "reports@elsewhere.example"); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.SetDomainDMARCAddress(local.ID, "ops@mail.example.com"); err != nil {
+		t.Fatal(err)
+	}
+
+	got, err := NewService(st, nil, "mail.example.com", true).AllowedRecipients()
+	if err != nil {
+		t.Fatalf("AllowedRecipients: %v", err)
+	}
+	want := []string{"dmarc-reports+hosted.example@mail.example.com", "dmarc-reports@mail.example.com", "ops@mail.example.com"}
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("allowed recipients = %v, want %v", got, want)
+	}
+}