panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/transfer.go

@@ -23,7 +23,7 @@ type DomainExport struct {
 	Domain         string           `json:"domain"`
 	DKIMSelector   string           `json:"dkim_selector"`
 	DKIMPrivateKey string           `json:"dkim_private_key"`    // PKCS#1 PEM
-	DMARCRua       *string          `json:"dmarc_rua,omitempty"` // nil = follows a user's default; set = the domain's own address ("" = none)
+	DMARCRua       string           `json:"dmarc_rua,omitempty"` // the domain's report address; absent = no reports
 	RateLimit      *RateLimitExport `json:"rate_limit,omitempty"`
 	Applications   []AppExport      `json:"applications"`
 }
@@ -71,14 +71,9 @@ func (s *Service) Export(id int64) (DomainExport, error) {
 		Domain:         d.Name,
 		DKIMSelector:   d.DKIMSelector,
 		DKIMPrivateKey: string(pem),
+		DMARCRua:       d.DMARCRua,
 		Applications:   make([]AppExport, 0, len(apps)),
 	}
-	// A domain that follows a user's default exports no address: users do not
-	// travel with a domain, and whoever imports it becomes the one it follows.
-	if !d.DMARCRuaUserID.Valid {
-		rua := d.DMARCRua
-		exp.DMARCRua = &rua
-	}
 	rl, ok, err := s.store.GetRateLimit(store.RateLimitScopeDomain, id)
 	if err != nil {
 		return DomainExport{}, fmt.Errorf("export rate limit for %s: %w", d.Name, err)
@@ -147,12 +142,12 @@ func (s *Service) Import(exp DomainExport) (store.Domain, error) {
 		return store.Domain{}, err
 	}
 
-	if exp.DMARCRua != nil {
-		if err := s.store.SetDomainDMARCAddress(d.ID, *exp.DMARCRua); err != nil {
+	if exp.DMARCRua != "" {
+		if err := s.store.SetDomainDMARCAddress(d.ID, exp.DMARCRua); err != nil {
 			s.importRollback(d.ID)
 			return store.Domain{}, err
 		}
-		d.DMARCRua = *exp.DMARCRua
+		d.DMARCRua = exp.DMARCRua
 	}
 	if exp.RateLimit != nil {
 		if err := s.importRateLimit(store.RateLimitScopeDomain, d.ID, *exp.RateLimit); err != nil {