base-trixie: findings of the reviews

Security review (1c6e04b):
- The panel's database and its -wal/-shm were 0644 under a traversable
  /data, holding the panel users' password hashes and session token
  hashes. store.Open now makes them 0600 (SQLite gives the next -wal/-shm
  the database's mode: findCreateFileMode(), unixOpenSharedMemory());
  TestOpenKeepsTheDatabasePrivate.
- The entrypoint removes a symbolic link the panel user could leave where
  a /data directory, table, map, the queue or mail.log is expected, before
  its root steps chmod or create them (drop_links).
- The panel user is 10999:10999, outside the system range: in trixie
  useradd gave it group 998, the host's systemd-network on the test
  server; bookworm's 999 was the host's systemd-journal.
- security.md said the database was 0640; it was 0644.

Technical review (1c6e04b):
- mail_helpers.go: smtp-sink does add a Received: header, "(smtp-sink)"
  (smtp-sink.c:520-531); the "(Postfix)" filter leaves it out.
- CHANGELOG/roadmap: OpenDKIM's signing and From:-parsing code is
  unchanged, not all of it; the retry-policy bug predates 3.9 (any
  postconf warning); three entries moved from Fixed to Changed, as no
  released image had them.
- internal/app/sasl.go: db_dump's stdout alone is parsed.
- mynetworks comment: postinst:180, fset_all_changed.

Tests: on the server, make e2e exit 0 (712 s), go vet + go test 27
packages ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/mail_helpers.go

@@ -78,8 +78,10 @@ func verifyDKIM(raw []byte, domain string) error {
 // postfixReceived returns the Received: headers of raw that a Postfix smtpd
 // wrote - "(Postfix)" after the host name, the only form it writes (Postfix
 // 3.10.13, src/smtpd/smtpd.c:3627-3645, "by %s (%s)" with var_mail_name).
-// In the stand only SelfPost's Postfix writes one: the sink is smtp-sink,
-// which adds none, and the tests compose their messages without any.
+// In the stand only SelfPost's Postfix writes one: the tests compose their
+// messages without any, and the sink, smtp-sink, adds its own with "by
+// <host> (smtp-sink)" (src/smtpstone/smtp-sink.c:520-531,
+// mail_file_finish_header()), which the "(Postfix)" filter leaves out.
 func postfixReceived(raw []byte) ([]string, error) {
 	msg, err := mail.ReadMessage(bytes.NewReader(raw))
 	if err != nil {