panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_dmarc.go

@@ -6,10 +6,16 @@ import (
 	"strings"
 
 	"github.com/mixeme/selfpost/internal/dmarc"
+	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/validate"
+	"github.com/mixeme/selfpost/internal/web/view"
 )
 
-// HandleDomainDMARC saves per-domain DMARC rua= settings.
+// HandleDomainDMARC saves where a domain's aggregate reports (rua=) go. The
+// form offers exactly three choices: "none", "hosted" (the address SelfPost
+// derives for the domain, offered only while hosted reports are enabled) and
+// "custom" (an address typed for the domain). What is stored is the address
+// alone; "" is no reports.
 func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		w.Header().Set("Allow", "POST")
@@ -25,9 +31,6 @@ func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// "inherit" makes the domain follow the default of the user who chose it;
-	// every other mode gives the domain an address of its own ("" = none).
-	follow := false
 	rua := ""
 	mode := strings.TrimSpace(r.PostFormValue("dmarc_rua_mode"))
 	// A refusal shows the form again with the choice that was made.
@@ -35,30 +38,19 @@ func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
 		h.renderDomainSettings(w, r, status, d, settingsView{Err: msg, RuaMode: mode, RuaCustom: strings.TrimSpace(r.PostFormValue("dmarc_rua_email"))})
 	}
 	switch mode {
-	case "keep":
-		// The domain follows another user's default and the form left it so.
-		// Anything else under this value is a stale or forged form.
-		if p, ok := h.principal(r); !ok || !d.DMARCRuaUserID.Valid || d.DMARCRuaUserID.Int64 == p.ID {
-			refuse(http.StatusBadRequest, "Choose how aggregate reports are addressed for this domain.")
-			return
-		}
-		http.Redirect(w, r, fmt.Sprintf("/outbound/domains/%d?dmarc=1", d.ID), http.StatusSeeOther)
-		return
-	case "inherit":
-		follow = true
-	case "none":
-	case "custom":
+	case ruaNone:
+	case ruaCustom:
 		email := strings.TrimSpace(r.PostFormValue("dmarc_rua_email"))
 		if err := validate.Email(email); err != nil {
 			refuse(http.StatusBadRequest, err.Error())
 			return
 		}
 		if email == "" {
-			refuse(http.StatusBadRequest, "Enter a custom report address or choose another mode.")
+			refuse(http.StatusBadRequest, "Enter the report address or choose another option.")
 			return
 		}
 		rua = email
-	case "hosted":
+	case ruaHosted:
 		if h.dmarc == nil || !h.dmarc.Enabled() {
 			refuse(http.StatusBadRequest, "SelfPost-hosted reports are not enabled on this server.")
 			return
@@ -69,22 +61,46 @@ func (h *Handlers) HandleDomainDMARC(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var err error
-	if p, ok := h.principal(r); follow && ok {
-		err = h.store.SetDomainDMARCUser(d.ID, p.ID)
-	} else {
-		err = h.store.SetDomainDMARCAddress(d.ID, rua)
-	}
-	if err != nil {
+	if err := h.store.SetDomainDMARCAddress(d.ID, rua); err != nil {
 		logf("panel: domain %d: save dmarc rua: %v", d.ID, err)
 		refuse(http.StatusInternalServerError, "Could not save DMARC settings. Please check the logs and try again.")
 		return
 	}
-	if h.dmarc != nil && h.dmarc.Enabled() {
-		if err := h.dmarc.Resync(); err != nil {
-			logf("panel: domain %d: dmarc resync: %v", d.ID, err)
-		}
-	}
+	h.resyncDMARC("domain report address")
 	h.dns.Forget(d.Name)
 	http.Redirect(w, r, fmt.Sprintf("/outbound/domains/%d?dmarc=1", d.ID), http.StatusSeeOther)
 }
+
+// The three choices of a domain's report address, the values of the select.
+const (
+	ruaNone   = view.ReportNone
+	ruaHosted = view.ReportHosted
+	ruaCustom = view.ReportCustom
+)
+
+// reportChoice says which of the three choices a domain's stored address is:
+// none for "", hosted for the address SelfPost derives for the domain (only
+// while hosted reports are enabled — otherwise it is just an address), custom
+// for anything else.
+func (h *Handlers) reportChoice(d store.Domain) string {
+	hosted := h.hostedDMARCAddress(d.Name)
+	switch {
+	case d.DMARCRua == "":
+		return ruaNone
+	case hosted != "" && strings.EqualFold(d.DMARCRua, hosted):
+		return ruaHosted
+	}
+	return ruaCustom
+}
+
+// resyncDMARC rebuilds the ingest allow-list after something that changes
+// where a domain's reports go. A failure is logged, not shown: the setting is
+// saved, and the next resync picks it up.
+func (h *Handlers) resyncDMARC(why string) {
+	if h.dmarc == nil || !h.dmarc.Enabled() {
+		return
+	}
+	if err := h.dmarc.Resync(); err != nil {
+		logf("panel: dmarc resync after %s change: %v", why, err)
+	}
+}