health: sockets dialled, the certificate Postfix serves, "deferred" only for the queue

Audit 2026-10-12, stage 2c, "Health says what is served"; the pages of
ea8b6bf's mockup.

Sockets (A-38). A unix socket's file outlives a killed OpenDKIM or panel
and refuses every connect() (unix(7)); Health said "Listening" from a
stat. CheckSocket and CheckMilter's unix case now dial: refused is
"Nothing listens on the ... socket: the program that made it has
stopped", EACCES is unknown (the panel may not connect), anything else
"does not answer". The probe closes before a byte, which no milter logs:
libmilter takes the EOF as SMFIC_EOF without a line (sendmail
8.17.1.9-2+deb12u2, the image's libmilter1.0.1, libmilter/comm.c
mi_rd_cmd(), engine.c mi_engine() - its source is now in dev/upstream),
OpenDKIM's mlfi_close() has no connection to free, go-milter v0.4.1
returns quietly on io.EOF (session.go, HandleMilterCommands()). The page
polls every 5 s while in view, so this mattered.

Certificate (A-65). Postfix serves build/postfix-config.sh's copy,
refreshed by cert-reload every TLS_RELOAD_INTERVAL_SECONDS. The panel now
reads smtpd_tls_cert_file from postconf -h at its start (as the retry
policy) and TLS_RELOAD_INTERVAL_SECONDS; CheckServedCertificate checks the
served copy and, when the mounted file differs byte for byte (cert-reload's
own cmp -s), names it as Renewal: its expiry and mtime, two facts on the
card. Waiting is fine for the interval: a nearing expiry of the served one
is then no warning (an expiry still an error); past interval + 1 h it is a
warning pointing at cert-reload's lines. The notifier sends no expiry
notice while a renewal waits on time.

Wording (D-P1, D-P3, and the same for the spam filter): Sender check
note, help topics sender-check, upstream, filter, certificate - word for
word as in the mockup; the filter row's detail too.

Tests: stale socket file (Linux) refused for CheckSocket and CheckMilter;
CheckServedCertificate (same, waiting, late, expired + waiting, no served
path); intervalText; the card's facts; the notifier quiet while a renewal
waits, speaking once it is late. Stand (2026-10-15, make e2e, exit 0):
new health_shows_what_is_served - the three sockets dialled ok by the
panel's user; a certificate mounted without its key is refused by
cert-reload ("do not belong together") and the card shows the served
expiry, "Renewal expires" with the mounted one's, "Renewal mounted", and
"Postfix still serves the certificate above."; a matching pair is then
served again. go vet and go test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_health_page_test.go

@@ -150,6 +150,31 @@ func TestHealthPageStatesOfTheOtherChecks(t *testing.T) {
 	}
 }
 
+// The certificate card names a renewal Postfix has not taken up yet: its
+// expiry and when it was mounted, beside the served one's (A-65).
+func TestHealthPageNamesARenewalWaiting(t *testing.T) {
+	h, _ := settingsServer(t)
+	c := healthReading()
+	cert := c["Cert"].(health.Certificate)
+	cert.Renewal = &health.Renewal{
+		NotAfter: time.Date(2027, 1, 31, 8, 2, 0, 0, time.UTC),
+		Mounted:  time.Date(2026, 10, 15, 3, 12, 0, 0, time.UTC),
+	}
+	cert.Detail = "Postfix still serves the certificate above. A renewed one is waiting in the mounted file."
+	c["Cert"] = cert
+	out := renderHealth(t, h, c, "")
+	for _, want := range []string{
+		"<dt>Expires</dt>", "2026-11-08 09:14 UTC",
+		"<dt>Renewal expires</dt>", "2027-01-31 08:02 UTC",
+		"<dt>Renewal mounted</dt>", "2026-10-15 03:12 UTC",
+		"Postfix still serves the certificate above.",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("health page is missing %q", want)
+		}
+	}
+}
+
 // The fragment is what the page holds in its polled rows, read again.
 func TestHealthFragmentCarriesTheSameRows(t *testing.T) {
 	h, _ := settingsServer(t)