fix(panel): P3 optional items — urlquery, aria-live, confirm-without-JS note

- Deliveries fragment/pagination links urlquery-encode the domain/app
  filters instead of splicing them into the query string raw.
- The four polled regions (deliveries rows, status, mail queue, system
  log) carry aria-live="polite" so a screen reader announces refreshes.
- security.md accepted risks note that data-confirm prompts are
  JavaScript-only and why that is acceptable.

docs/plans/code-review.md P3 fully checked off; CHANGELOG updated.

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -551,7 +551,7 @@ roles, and security.md no longer calls the panel single-user.
       domain delete. Done as a confirm page (`GET/POST /users/{uid}/delete`),
       matching `domain_delete.html`.
 - [x] DNS field partial; settings credentials partial.
-- [ ] Optional: `urlquery` on deliveries fragment params; `aria-live` on
+- [x] Optional: `urlquery` on deliveries fragment params; `aria-live` on
       polled regions; confirm-without-JS note next to the CSRF accepted risks.
 
 **Done when:** a rate-limit validation error is visually an error; user delete