panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/schema_test.go

@@ -40,9 +40,9 @@ func TestBaselineSchema(t *testing.T) {
 	st := openTestStore(t)
 	want := map[string]string{
 		"settings":              "key value",
-		"users":                 "id username password_hash role email dmarc_default_mode dmarc_default_address all_domains all_inbound_domains created_at",
+		"users":                 "id username password_hash role email all_domains all_inbound_domains created_at",
 		"sessions":              "token_hash user_id created_at expires_at",
-		"domains":               "id name dkim_selector dmarc_rua dmarc_rua_user_id created_at",
+		"domains":               "id name dkim_selector dmarc_rua created_at",
 		"user_domains":          "user_id domain_id",
 		"applications":          "id domain_id login address_mode auth_ip_restrict auth_allowed_ips created_at",
 		"application_addresses": "id application_id address",
@@ -223,33 +223,30 @@ func TestOpenRefusesANewerSchema(t *testing.T) {
 // table does when either side goes away.
 func TestBaselineConstraints(t *testing.T) {
 	st := openTestStore(t)
-	insert := func(role, mode string, all int) error {
+	insert := func(name, role string, all int) error {
 		_, err := st.db.Exec(
-			"INSERT INTO users (username, password_hash, role, dmarc_default_mode, all_domains, created_at) VALUES (?, 'h', ?, ?, ?, 'now')",
-			role+mode, role, mode, all)
+			"INSERT INTO users (username, password_hash, role, all_domains, created_at) VALUES (?, 'h', ?, ?, 'now')",
+			name, role, all)
 		return err
 	}
-	if err := insert("global", "none", 0); err != nil {
+	if err := insert("plain", "global", 0); err != nil {
 		t.Fatalf("a plain global user: %v", err)
 	}
-	if err := insert("domain", "hosted", 1); err != nil {
+	if err := insert("everything", "domain", 1); err != nil {
 		t.Fatalf("a domain user with All: %v", err)
 	}
-	if err := insert("domain_admin", "none", 0); err == nil {
+	if err := insert("old-role", "domain_admin", 0); err == nil {
 		t.Error("the 1.x role name domain_admin was accepted")
 	}
-	if err := insert("global", "profile", 0); err == nil {
-		t.Error("an unknown dmarc_default_mode was accepted")
-	}
-	if err := insert("domain", "custom", 2); err == nil {
+	if err := insert("two", "domain", 2); err == nil {
 		t.Error("all_domains = 2 was accepted")
 	}
 
-	u, err := st.GetUserByUsername("domainhosted")
+	u, err := st.GetUserByUsername("everything")
 	if err != nil {
 		t.Fatalf("GetUserByUsername: %v", err)
 	}
-	if !u.AllDomains || u.AllInboundDomains || u.DMARCDefaultMode != DMARCDefaultHosted {
+	if !u.AllDomains || u.AllInboundDomains {
 		t.Errorf("flags read back as %+v", u)
 	}