panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/server_test.go

@@ -316,34 +316,18 @@ func TestEveryHelpLinkLandsOnATopic(t *testing.T) {
 // change it under Account, and it can receive DMARC reports if they choose.
 func TestUserFormEmailHelpSaysOnlyWhatIsTrue(t *testing.T) {
 	out := renderSignedIn(t, "user", userFixture())
-	pageHas(t, "User", out, `The user's own address. They can change it under Account, and can choose it there as the address that receives DMARC reports.`)
+	pageHas(t, "User", out, `The user's own address. They can change it under Account.`)
 	pageLacks(t, "User", out, `notification`, `reset`)
 }
 
-// With domains that follow the user's default report address, deleting them
-// leaves those domains with none, and the page says so: up to three names, then
-// the count of the rest. With none following, the page says nothing about it.
-func TestUserDeleteSaysWhichDomainsLoseTheirReportAddress(t *testing.T) {
-	for _, tt := range []struct {
-		following []string
-		want      string
-	}{
-		{[]string{"example.org"}, `<strong>example.org</strong> will have no DMARC report address until someone sets one.`},
-		{[]string{"example.org", "shop.example.org"}, `<strong>example.org</strong> and <strong>shop.example.org</strong> will have no DMARC report address until someone sets one.`},
-		{[]string{"a.example", "b.example", "c.example"}, `<strong>a.example</strong>, <strong>b.example</strong> and <strong>c.example</strong> will have no DMARC report address`},
-		{[]string{"a.example", "b.example", "c.example", "d.example", "e.example"}, `<strong>a.example</strong>, <strong>b.example</strong>, <strong>c.example</strong> and 2 more will have no DMARC report address`},
+// A domain's report address belongs to the domain, not to a user: deleting a
+// user, global or not, says nothing about any domain losing one.
+func TestUserDeleteSaysNothingOfReportAddresses(t *testing.T) {
+	for _, in := range []UserDeleteInput{
+		{ID: 3, Username: "acme-ops", AllOutbound: true, Outbound: []string{"example.org"}},
+		{ID: 2, Username: "root", Global: true},
 	} {
-		in := UserDeleteInput{ID: 3, Username: "acme-ops", AllOutbound: true, Following: tt.following}
 		out := renderSignedIn(t, "user-delete", NewUserDelete(admin(), in))
-		pageHas(t, "Delete user", out, tt.want)
-		if strings.Contains(out, "d.example") && len(tt.following) > 3 {
-			t.Errorf("a fourth name is spelled out: %v", tt.following)
-		}
+		pageLacks(t, "Delete user", out, `report address`, `will have no`, `The domains`)
 	}
-	// A global user's domains follow them as well.
-	out := renderSignedIn(t, "user-delete", NewUserDelete(admin(), UserDeleteInput{ID: 2, Username: "root", Global: true, Following: []string{"example.org"}}))
-	pageHas(t, "Delete user", out, `will have no DMARC report address`)
-
-	out = renderSignedIn(t, "user-delete", userDeleteFixture())
-	pageLacks(t, "Delete user", out, `DMARC report address`, `The domains`)
 }