send log: rows belong to a domain by id (audit L12, 0008)

A domain user's log, the message page, a domain's statistics, the level-2
count and the notifier's refusal count picked send-log rows by domain name,
so a domain deleted and re-added under its old name showed its earlier mail
to the next assignee and went on counting it.

Migration 0008 (not run on the live database yet, so extended here):
send_log.domain_id and inbound_spam_log.inbound_domain_id, REFERENCES ...
ON DELETE SET NULL, filled once by name from the registry as it is at
migration time, each with an (id, created_at) index.

- Writes: InsertQueued / InsertRejected set domain_id to the domain of the
  row's login (loginDomainID) - the journal milter and the sender check's
  refusal rows both go through them; the inbound journal sets
  inbound_domain_id from the inbound domain's name at insert.
- Reads: SendLogFilter.DomainIDs (was Domains, by name) and
  InboundSpamFilter.DomainIDs are the scope; the global role still reads
  everything. The message page checks row.DomainID against the user's
  domains. DomainSendStats and CountMessages keep their name argument and
  select domain_id = (SELECT id FROM domains WHERE name = ?). The notifier
  joins send_log.domain_id to the domain and its application.
- DMARC reports stay by name on purpose (a report is about the DNS name).

Tests: store - scope by ids; a re-added domain's log, level-2 count and
statistics hold its own row only, the global log both; inbound scope by
ids. Handlers - the new assignee gets 404 for the old row's page and does
not see it in the log, the global role sees both. Tests that wrote rows for
a login that is no application now register it (a row is a domain's through
its application). Schema at 0008 with the two columns and indexes.

schema-migrations row 8, CHANGELOG [Unreleased], audit plan line ticked,
roadmap 19/62.
Evidence: go vet ./... clean; go test ./... ok locally but for the two
Windows-only tests; the server run follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/inboundspam_test.go

@@ -172,6 +172,14 @@ func TestQueryInboundSpamFilters(t *testing.T) {
 			t.Fatalf("InsertInboundSpam: %v", err)
 		}
 	}
+	ids := map[string]int64{}
+	for _, name := range []string{"a.example", "b.example"} {
+		d, err := st.AddInboundDomain(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ids[name] = d.ID
+	}
 	add("a.example", "1@a.example", SpamDecisionAccept, day(20, 23))
 	add("a.example", "2@a.example", SpamDecisionReject, day(21, 0))
 	add("b.example", "3@b.example", SpamDecisionAccept, day(21, 12))
@@ -227,13 +235,13 @@ func TestQueryInboundSpamFilters(t *testing.T) {
 
 	// The scope: nil is everything, a set is its domains, an empty set nothing,
 	// and a chosen domain outside the set is nothing too.
-	if got := to(InboundSpamFilter{Domains: []string{"b.example"}}); got != "43" {
+	if got := to(InboundSpamFilter{DomainIDs: []int64{ids["b.example"]}}); got != "43" {
 		t.Errorf("scope = %q, want 43", got)
 	}
-	if got := to(InboundSpamFilter{Domains: []string{}}); got != "" {
+	if got := to(InboundSpamFilter{DomainIDs: []int64{}}); got != "" {
 		t.Errorf("empty scope = %q, want nothing", got)
 	}
-	if got := to(InboundSpamFilter{Domains: []string{"b.example"}, Domain: "a.example"}); got != "" {
+	if got := to(InboundSpamFilter{DomainIDs: []int64{ids["b.example"]}, Domain: "a.example"}); got != "" {
 		t.Errorf("a chosen domain outside the scope = %q, want nothing", got)
 	}