health-setup-checks: the certificate's name, Postfix's greeting, the proxy

Decided by the owner on 2026-10-13 (in place of preflight), taken up on
2026-10-16; mockups b2dcefc, cc33890, 0feaa55 (his: the greeting on a row
of its own, the name check a tag beside Names).

- The certificate: health.Certificate keeps its names (DNS names, or the
  CN without any) and ForHost holds it to SELFPOST_HOSTNAME as a TLS
  client does - VerifyHostname over the DNS names, the CN only without
  any, as OpenSSL's X509_check_host and so a sending Postfix still take it
  (src/tls/tls_client.c:439, 513). A certificate for another name fails;
  the tag beside Names says matches / not for the hostname.
- The greeting: postconf -x -h smtpd_banner, read once at the panel's
  start like the served certificate's path (main.cf is not rewritten
  after), is what smtpd writes after "220 " (src/smtpd/smtpd.c:5979). A
  first word other than the hostname warns, with what to set. A fact may
  now take the whole row (Fact.Wide, sp-wide) and carry a tag beside its
  label (Fact.LabelTag); both on the kit page.
- The proxy: auth.Module.Seen says the address the panel counts sign-ins
  against, the peer, and whether X-Forwarded-For was read or left unread
  for an untrusted peer; the Configuration card shows "Your address" and,
  in the second case, warns that every visitor shares one sign-in limit
  and names the /32 (or /128) to put in TRUSTED_PROXY_CIDR.

Tests: TestCertificateForHost (CN-only, DNS names, a wildcard, the CN
ignored beside DNS names), TestSeenAddress, TestHealthSaysWhereItSeesTheViewer,
TestHealthGreetingAndCertificateName; e2e reads the stand's right state on
Health (matches, "220 mail.e2e.test ESMTP", a direct client). go vet + go
test (26 packages) and make e2e on the test server for this tree.

Docs: help (word for word with the mockup), guide § Overview and Health,
CHANGELOG [Unreleased] § Added, roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -468,8 +468,10 @@ readings, in the order of what stops mail first:
   one refresh after the page opens. A fully busy processor or a machine out of
   memory is a warning, because both delay or kill the mail path; throughput is
   only reported.
-- **Processes**, **TLS certificate** (validity and expiry) and **Milter
-  sockets**: the DKIM signer's two - `dkim-signer · applications` for what
+- **Processes**, **TLS certificate** (validity and expiry, and whether its
+  names cover `SELFPOST_HOSTNAME` - the tag beside *Names*; a certificate for
+  another name fails, as a client that checks the name refuses it) and
+  **Milter sockets**: the DKIM signer's two - `dkim-signer · applications` for what
   applications send on 465/587, `dkim-signer · notifications` for the
   panel's own mail - the sender check, the send log (the journal-milter)
   and, with one configured, the spam filter. Postfix attaches the signer
@@ -493,7 +495,14 @@ readings, in the order of what stops mail first:
 - **Hostname and reverse DNS** — compares `SELFPOST_HOSTNAME` against the PTR
   record the internet publishes for this server's IP (forward-confirmed
   reverse DNS), see [Server-level DNS](#server-level-dns-ptrrdns); use
-  *Re-check DNS* after changing DNS.
+  *Re-check DNS* after changing DNS. *Greeting* is the `220` line Postfix
+  opens every connection with; it must name the hostname, and another name
+  there is a warning.
+- **Your address** (in the Configuration card) — the address the panel sees
+  your browser at, and whether it took it from `X-Forwarded-For`. Behind a
+  reverse proxy that the panel does not trust it is the proxy's own: every
+  visitor then shares one sign-in limit, and the card says what to set in
+  `TRUSTED_PROXY_CIDR`.
 - **Configuration** — the **Reload configuration** button writes again, from
   the database, every file the panel keeps for the mail path - the DKIM
   selector table (`/data/dkim/selectors`), the Postfix sender map, the