health-setup-checks: the certificate's name, Postfix's greeting, the proxy

Decided by the owner on 2026-10-13 (in place of preflight), taken up on
2026-10-16; mockups b2dcefc, cc33890, 0feaa55 (his: the greeting on a row
of its own, the name check a tag beside Names).

- The certificate: health.Certificate keeps its names (DNS names, or the
  CN without any) and ForHost holds it to SELFPOST_HOSTNAME as a TLS
  client does - VerifyHostname over the DNS names, the CN only without
  any, as OpenSSL's X509_check_host and so a sending Postfix still take it
  (src/tls/tls_client.c:439, 513). A certificate for another name fails;
  the tag beside Names says matches / not for the hostname.
- The greeting: postconf -x -h smtpd_banner, read once at the panel's
  start like the served certificate's path (main.cf is not rewritten
  after), is what smtpd writes after "220 " (src/smtpd/smtpd.c:5979). A
  first word other than the hostname warns, with what to set. A fact may
  now take the whole row (Fact.Wide, sp-wide) and carry a tag beside its
  label (Fact.LabelTag); both on the kit page.
- The proxy: auth.Module.Seen says the address the panel counts sign-ins
  against, the peer, and whether X-Forwarded-For was read or left unread
  for an untrusted peer; the Configuration card shows "Your address" and,
  in the second case, warns that every visitor shares one sign-in limit
  and names the /32 (or /128) to put in TRUSTED_PROXY_CIDR.

Tests: TestCertificateForHost (CN-only, DNS names, a wildcard, the CN
ignored beside DNS names), TestSeenAddress, TestHealthSaysWhereItSeesTheViewer,
TestHealthGreetingAndCertificateName; e2e reads the stand's right state on
Health (matches, "220 mail.e2e.test ESMTP", a direct client). go vet + go
test (26 packages) and make e2e on the test server for this tree.

Docs: help (word for word with the mockup), guide § Overview and Health,
CHANGELOG [Unreleased] § Added, roadmap row done.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/health_served_test.go

@@ -148,13 +148,26 @@ func writeCertWithoutItsKey(certPath string, notAfter time.Time) error {
 // panel sent until 2.5.2 and which the origin check refuses (assumptions
 // D-B3). The client here is not a browser: it sends what one would.
 func testFormPostWithTheBrowsersOrigin(t *testing.T, sc *scenario) {
-	resp, _, err := sc.panel.get("/server/health")
+	resp, page, err := sc.panel.get("/server/health")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if got := resp.Header.Get("Referrer-Policy"); got != "same-origin" {
 		t.Fatalf("Referrer-Policy %q, want same-origin", got)
 	}
+	// The setup checks of health-setup-checks, on a stand that passes them:
+	// the stand's certificate is for its hostname, Postfix greets with it
+	// (postconf -x smtpd_banner, read at the panel's start), and the client
+	// reaches the panel directly, with no proxy in between.
+	for _, want := range []string{
+		`<dt>Names <span class="tag is-success is-light">matches</span></dt>`,
+		`<div class="sp-wide"><dt>Greeting</dt><dd class="sp-mono">220 ` + selfpostHostname + ` ESMTP</dd>`,
+		`<dt>Your address</dt>`, `The connection&#39;s own; no proxy in between said otherwise`,
+	} {
+		if !strings.Contains(page, want) {
+			t.Fatalf("Server › Health lacks %q:\n%.3000s", want, page)
+		}
+	}
 	post := func(origin string) int {
 		t.Helper()
 		req, err := http.NewRequest(http.MethodPost, panelBaseURL+"/server/health/recheck", strings.NewReader(""))