panel-redesign: three choices for a domain's report address; row actions

Follows the design and guard commits before it. Written by Sonnet,
reviewed by Opus.

The report address
  - Baseline: users.dmarc_default_mode, users.dmarc_default_address and
    domains.dmarc_rua_user_id are gone. domains.dmarc_rua alone says
    where reports go: '' is no reports (a new domain), the address
    SelfPost derives for the domain is the hosted choice (while hosted
    reports are on), anything else is a typed address.
  - Removed: the user default and its store functions, a domain
    following a user, keep / inherit, followCreator, POST /account/dmarc
    with its handler, the DMARC box of Account, the user-delete item
    about domains losing their address.
  - Domain settings offers the three choices; beside the typed address a
    "Use my e-mail" button fills in the profile e-mail (panel.js: one
    generic data-fill hook; absent without a profile e-mail; it fills,
    it does not save).
  - The DMARC record's note names the address and no user. This closes
    L4 of the security review.
  - Domain export / import carries the address as a plain string.
  - The ingest allow-list is the generic mailbox plus each domain's
    address on this host; the generic mailbox is always open now.
  - dev/migrate1x (not in the tree): a 1.x domain that inherited the
    instance default gets that address as its own, so no published rua=
    changes.

Row actions
  - row_action partial (RowAction: Label, Post, Confirm, Danger);
    panel.css has the mockup's three rules. A row of the Applications
    table is Edit, New password, Delete; the confirmation texts are the
    ones the application page's head uses. Both roles, with the checks
    of the application page.

Tests cover: a new domain has no reports; each choice saved and shown
selected; hosted refused when hosted reports are off; a bad address
refused with what was typed kept; an untouched save changes nothing in
each state; the fill button with and without a profile e-mail; deleting
a user leaves every domain's address; the row's forms, targets and
confirmations for both roles and a 404 for a stranger.

Known: if hosted reports are switched off later, a stored hosted address
reads as a typed one. docs/guide.md still describes the old choices -
the documentation step.

Evidence
  - docs/assets/panel-redesign/evidence/account.png,
    out-domain-settings.png, out-domain.png, user-delete.png, help.png:
    1440 px wide, headless Edge, real templates served locally with
    their fixtures - NOT from the container.
  - panel/audit.js on out-domain, out-domain-settings, account, help,
    components and user-delete at 1440 and 1280: 1420 texts checked,
    problems: [].
  - In a browser: the fill button sets the field and does not submit;
    the row buttons have the font, size and colour of the Edit link,
    Delete the red of the other delete links; data-confirm fires on
    both. Hover and focus states were not observed.
  - go test -count=1 ./internal/web/... ./internal/store/...
    ./internal/dmarc/... ./internal/app/... ./internal/inbound/...
    ./cmd/panel: ok (ten packages; dev/migrate1x also ok).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/static/panel.css

@@ -218,7 +218,14 @@ code { background: var(--sp-well); color: var(--sp-ink); border-radius: 3px; pad
 .box > .table-container td:first-child, .box > .table-container th:first-child { padding-left: 1.25rem; }
 .box > .table-container td:last-child, .box > .table-container th:last-child { padding-right: 1.25rem; }
 .table td.sp-actions { text-align: right; white-space: nowrap; }
-.table td.sp-actions a { margin-left: .9rem; }
+/* An action that changes state (New password, Delete) is a POST, so it is a form
+   with a button, not a link. The form sits inline like the links beside it and
+   the button is handed the link's colour and type; Bulma already resets the
+   button and shares the pointer and the focus ring between a and button, and a
+   link here has no hover colour of its own. */
+.table td.sp-actions a, .table td.sp-actions form { margin-left: .9rem; }
+.table td.sp-actions form { display: inline; }
+.table td.sp-actions button { color: var(--bulma-link-text); font: inherit; }
 .table td.sp-clip { max-width: 13rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .tag { font-family: var(--sp-mono); font-weight: 600; letter-spacing: .04em; }
 .sp-empty { padding: 2.2rem 1.25rem; text-align: center; color: var(--sp-muted); }

internal/web/view/static/panel.js

@@ -42,6 +42,26 @@
     });
   });
 
+  // --- Fill buttons -----------------------------------------------------
+  // A type="button" with data-fill="<id of an input>" and data-fill-value="<text>"
+  // puts the text in that input and tells the page it changed. It only fills:
+  // saving stays the form's own button. Without scripts the button does nothing
+  // and the field can be typed in.
+  document.addEventListener("click", function (ev) {
+    var button = ev.target.closest("button[data-fill]");
+    if (!button) {
+      return;
+    }
+    var input = document.getElementById(button.dataset.fill);
+    if (!input) {
+      return;
+    }
+    input.value = button.dataset.fillValue || "";
+    input.dispatchEvent(new Event("input", { bubbles: true }));
+    input.dispatchEvent(new Event("change", { bubbles: true }));
+    input.focus();
+  });
+
   // --- Confirmation on destructive forms --------------------------------
   // Forms that delete something or invalidate a working credential carry a
   // data-confirm message. The prompt lives here rather than in an inline