base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -518,11 +518,11 @@ deferred item from the roadmap.
 - **The filter lists are files readable by anyone on the host.**
   `/data/antispam` is 0755 and its six files 0644, unlike the rest of `/data`:
   the filter runs under another user in another container (rspamd as
-  `_rspamd`, uid 11333, in `rspamd/rspamd:3.11.1-3`; the panel is uid 999 -
-  measured on a live server, 2026-10-15). They hold sender
+  `_rspamd`, uid 11333, in `rspamd/rspamd:3.11.1-3`, measured on a live
+  server, 2026-10-15; the panel is uid 10999 since `2.7.0`). They hold sender
   addresses, domains and networks - who the operator blocks and whom he lets
   through - but no message data. The inbound journal itself is in the
-  database, 0640. Trigger to revisit: a shared host, where the sidecar should
+  database, which is 0600 since `2.7.0` (0644 before). Trigger to revisit: a shared host, where the sidecar should
   instead be given the files through a group it shares with the panel.
 - ~~**An application can learn which domains are senders of this server.**~~
   Struck in `2.5.2` (audit 2026-10-12, stage 2c; L8 closed): the sender