panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/server.go

@@ -359,9 +359,6 @@ type UserDeleteInput struct {
 	AllInbound  bool
 	Outbound    []string
 	Inbound     []string
-	// Following names the domains whose DMARC report address is this user's
-	// default: with the user gone they have none.
-	Following []string
 }
 
 // NewUserDelete builds the page.
@@ -386,7 +383,7 @@ func NewUserDelete(m Meta, in UserDeleteInput) *UserDelete {
 	}
 	if in.Global {
 		p.Consequences = append(p.Consequences, Plain("remove their global access to the server and to every domain."))
-		return p.withFollowing(in.Following)
+		return p
 	}
 	var out, inb Text
 	switch {
@@ -409,39 +406,6 @@ func NewUserDelete(m Meta, in UserDeleteInput) *UserDelete {
 	case len(inb) > 0:
 		p.Consequences = append(p.Consequences, Rich("remove the assignments to ", inb, " (inbound)."))
 	}
-	return p.withFollowing(in.Following)
-}
-
-// followingShown is how many domain names the DMARC consequence spells out
-// before it says "and N more".
-const followingShown = 3
-
-// withFollowing adds what deleting the user does to the domains that report to
-// their default address: they are left with none. Nothing is added when no
-// domain follows the user.
-func (p *UserDelete) withFollowing(domains []string) *UserDelete {
-	if len(domains) == 0 {
-		return p
-	}
-	shown, more := domains, 0
-	if len(domains) > followingShown {
-		shown, more = domains[:followingShown], len(domains)-followingShown
-	}
-	var list Text
-	for i, n := range shown {
-		switch {
-		case i == 0:
-		case i == len(shown)-1 && more == 0:
-			list = append(list, Inline{Text: " and "})
-		default:
-			list = append(list, Inline{Text: ", "})
-		}
-		list = append(list, Strong(n))
-	}
-	if more > 0 {
-		list = append(list, Inline{Text: " and " + strconv.Itoa(more) + " more"})
-	}
-	p.Consequences = append(p.Consequences, Rich(list, " will have no DMARC report address until someone sets one."))
 	return p
 }