send log: rows belong to a domain by id (audit L12, 0008)

A domain user's log, the message page, a domain's statistics, the level-2
count and the notifier's refusal count picked send-log rows by domain name,
so a domain deleted and re-added under its old name showed its earlier mail
to the next assignee and went on counting it.

Migration 0008 (not run on the live database yet, so extended here):
send_log.domain_id and inbound_spam_log.inbound_domain_id, REFERENCES ...
ON DELETE SET NULL, filled once by name from the registry as it is at
migration time, each with an (id, created_at) index.

- Writes: InsertQueued / InsertRejected set domain_id to the domain of the
  row's login (loginDomainID) - the journal milter and the sender check's
  refusal rows both go through them; the inbound journal sets
  inbound_domain_id from the inbound domain's name at insert.
- Reads: SendLogFilter.DomainIDs (was Domains, by name) and
  InboundSpamFilter.DomainIDs are the scope; the global role still reads
  everything. The message page checks row.DomainID against the user's
  domains. DomainSendStats and CountMessages keep their name argument and
  select domain_id = (SELECT id FROM domains WHERE name = ?). The notifier
  joins send_log.domain_id to the domain and its application.
- DMARC reports stay by name on purpose (a report is about the DNS name).

Tests: store - scope by ids; a re-added domain's log, level-2 count and
statistics hold its own row only, the global log both; inbound scope by
ids. Handlers - the new assignee gets 404 for the old row's page and does
not see it in the log, the global role sees both. Tests that wrote rows for
a login that is no application now register it (a row is a domain's through
its application). Schema at 0008 with the two columns and indexes.

schema-migrations row 8, CHANGELOG [Unreleased], audit plan line ticked,
roadmap 19/62.
Evidence: go vet ./... clean; go test ./... ok locally but for the two
Windows-only tests; the server run follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/sendlog_test.go

@@ -274,7 +274,13 @@ func TestUpdateStatusNoMatch(t *testing.T) {
 // decided who is asking, and the safe answer to that is nothing.
 func TestSendLogScopeIsMandatory(t *testing.T) {
 	st := openTestStore(t)
+	ids := map[string]int64{}
 	for _, domain := range []string{"first.example.ru", "second.example.ru"} {
+		d := addTestDomain(t, st, domain)
+		ids[domain] = d.ID
+		if _, err := st.AddApplication(d.ID, "app-"+domain, AddressModeWildcard, nil); err != nil {
+			t.Fatal(err)
+		}
 		if err := st.InsertQueued(SendLogEntry{
 			QueueID: "Q-" + domain, Domain: domain, AppLogin: "app-" + domain,
 			From: "noreply@" + domain, To: "public@example.net", Subject: domain,
@@ -288,14 +294,14 @@ func TestSendLogScopeIsMandatory(t *testing.T) {
 		want   []string
 	}{
 		"no scope":           {SendLogFilter{}, nil},
-		"empty scope":        {SendLogFilter{Domains: []string{}}, nil},
+		"empty scope":        {SendLogFilter{DomainIDs: []int64{}}, nil},
 		"all domains":        {SendLogFilter{AllDomains: true}, []string{"first.example.ru", "second.example.ru"}},
-		"one domain":         {SendLogFilter{Domains: []string{"first.example.ru"}}, []string{"first.example.ru"}},
-		"two domains":        {SendLogFilter{Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru", "second.example.ru"}},
-		"unknown domain":     {SendLogFilter{Domains: []string{"third.example.ru"}}, nil},
-		"filter within":      {SendLogFilter{Domain: "first.example.ru", Domains: []string{"first.example.ru", "second.example.ru"}}, []string{"first.example.ru"}},
-		"filter outside":     {SendLogFilter{Domain: "second.example.ru", Domains: []string{"first.example.ru"}}, nil},
-		"app filter outside": {SendLogFilter{AppLogin: "app-second.example.ru", Domains: []string{"first.example.ru"}}, nil},
+		"one domain":         {SendLogFilter{DomainIDs: []int64{ids["first.example.ru"]}}, []string{"first.example.ru"}},
+		"two domains":        {SendLogFilter{DomainIDs: []int64{ids["first.example.ru"], ids["second.example.ru"]}}, []string{"first.example.ru", "second.example.ru"}},
+		"unknown domain":     {SendLogFilter{DomainIDs: []int64{9999}}, nil},
+		"filter within":      {SendLogFilter{Domain: "first.example.ru", DomainIDs: []int64{ids["first.example.ru"], ids["second.example.ru"]}}, []string{"first.example.ru"}},
+		"filter outside":     {SendLogFilter{Domain: "second.example.ru", DomainIDs: []int64{ids["first.example.ru"]}}, nil},
+		"app filter outside": {SendLogFilter{AppLogin: "app-second.example.ru", DomainIDs: []int64{ids["first.example.ru"]}}, nil},
 	} {
 		rows, err := st.QuerySendLog(tc.filter, 50, 0)
 		if err != nil {
@@ -352,3 +358,46 @@ func TestDeleteSendLogBefore(t *testing.T) {
 		t.Fatalf("retention kept wrong rows: %+v", rows)
 	}
 }
+
+// A domain deleted and added again under its old name starts with an empty
+// log for whoever it is assigned to: its earlier rows belong to no domain and
+// only the global role reads them (audit 2026-10-12, L12). Statistics and the
+// level-2 count follow the same rule.
+func TestADomainAddedAgainStartsWithAnEmptyLog(t *testing.T) {
+	st := openTestStore(t)
+	old := addTestDomain(t, st, "shop.example")
+	if _, err := st.AddApplication(old.ID, "shop", AddressModeWildcard, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.InsertQueued(SendLogEntry{QueueID: "OLD", Domain: "shop.example", AppLogin: "shop", To: "a@example.net"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.DeleteDomain(old.ID); err != nil {
+		t.Fatal(err)
+	}
+	again := addTestDomain(t, st, "shop.example")
+	if _, err := st.AddApplication(again.ID, "shop", AddressModeWildcard, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := st.InsertQueued(SendLogEntry{QueueID: "NEW", Domain: "shop.example", AppLogin: "shop", To: "a@example.net"}); err != nil {
+		t.Fatal(err)
+	}
+
+	rows, err := st.QuerySendLog(SendLogFilter{DomainIDs: []int64{again.ID}}, 10, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || rows[0].QueueID != "NEW" || rows[0].DomainID != again.ID {
+		t.Fatalf("the new domain's log = %+v, want its own row alone", rows)
+	}
+	all, _ := st.QuerySendLog(SendLogFilter{AllDomains: true}, 10, 0)
+	if len(all) != 2 {
+		t.Fatalf("the global log has %d rows, want both", len(all))
+	}
+	if n, err := st.CountMessages(RateLimitScopeDomain, "shop.example", time.Now().Add(-time.Hour)); err != nil || n != 1 {
+		t.Fatalf("level-2 count = %d, %v; want the new domain's one message", n, err)
+	}
+	if stats, err := st.DomainSendStats("shop.example", 90, time.Now().Add(-time.Hour)); err != nil || stats.Total != 1 {
+		t.Fatalf("statistics = %+v, %v; want one message", stats, err)
+	}
+}