review follow-up: close the gaps left by the phase1-6 pass

Verified the tree against docs/plans/code-review-2026-08.md and finished the
tasks that were only partly done, plus two defects the pass introduced.

- bcrypt: the setup account was still hashed at DefaultCost (10). The work
  factor now has one definition, auth.BcryptCost = 12, used everywhere.
- rate limiter: protecting blocked buckets from eviction was unbounded — an
  attacker with many source addresses could grow the map by making each one
  fail its way to blocked. Blocked buckets are now evicted past
  maxBuckets * 4, nearest expiry first, logged once per window. Tests cover
  both halves.
- postqueue: the 5s timeout left the output size unbounded; reads are now
  capped at 4 MiB and report truncation.
- spec references: the ~76 `spec N` citations CHANGELOG [0.5.0] claimed were
  gone are removed from build/, deploy/, the first two migrations and the
  release workflow, with the affected comment paragraphs re-wrapped. Comments
  only; shell/YAML/SQL syntax re-checked.
- schema-migrations.md: schema section was headed v9 with the chain at v10,
  and three links pointed at deleted plan files.
- internal/configsafe: the shared empty/forbidden-character check behind the
  OpenDKIM and Postfix config writers; each writer keeps its own forbidden set.
- dropped the parseDomainRateLimitForm/parseAppRateLimitForm pass-throughs
  left behind by the parser merge (only their own tests still called them).
- plan doc now carries a status table: what shipped, what was already in
  place, what was declined (//go:build linux for the /proc reader) and the
  open CSRF-token question.

Not done, each its own phase: typed template data structs, log/slog, DMARC
service and handler tests, error-page/corrupted-backup tests, backup re-auth.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/store/migrations/0001_init.sql

@@ -1,9 +1,9 @@
--- Initial SelfPost schema (spec 9). One SQLite file under /data holds the whole
--- panel state so a single directory backup/restore is sufficient (spec 7.5.A).
+-- Initial SelfPost schema. One SQLite file under /data holds the whole panel
+-- state so a single directory backup/restore is sufficient.
 
--- Single administrator account (spec 7.6.1). Exactly one row is allowed; the
--- presence of that row is what marks primary setup as complete, which is why
--- the /setup route disappears once it exists.
+-- Single administrator account. Exactly one row is allowed; the presence of
+-- that row is what marks primary setup as complete, which is why the /setup
+-- route disappears once it exists.
 CREATE TABLE admin (
     id            INTEGER PRIMARY KEY CHECK (id = 1),
     username      TEXT NOT NULL,
@@ -17,8 +17,8 @@ CREATE TABLE settings (
     value TEXT NOT NULL
 );
 
--- Sending domains managed through the panel (spec 4.1). DKIM keys themselves
--- live on disk under /data; this row records the selector and metadata.
+-- Sending domains managed through the panel. DKIM keys themselves live on disk
+-- under /data; this row records the selector and metadata.
 CREATE TABLE domains (
     id            INTEGER PRIMARY KEY AUTOINCREMENT,
     name          TEXT NOT NULL UNIQUE,
@@ -26,8 +26,8 @@ CREATE TABLE domains (
     created_at    TEXT NOT NULL
 );
 
--- Applications bound to a domain (spec 4.1). address_mode is either the domain
--- wildcard or an explicit address list; the SASL login is globally unique.
+-- Applications bound to a domain. address_mode is either the domain wildcard or
+-- an explicit address list; the SASL login is globally unique.
 CREATE TABLE applications (
     id           INTEGER PRIMARY KEY AUTOINCREMENT,
     domain_id    INTEGER NOT NULL REFERENCES domains(id) ON DELETE CASCADE,
@@ -37,7 +37,7 @@ CREATE TABLE applications (
 );
 
 -- Explicit sender addresses for applications in 'list' mode. Each address must
--- belong to the application's domain (validated in the panel, spec 7.6.2).
+-- belong to the application's domain (validated in the panel).
 CREATE TABLE application_addresses (
     id             INTEGER PRIMARY KEY AUTOINCREMENT,
     application_id INTEGER NOT NULL REFERENCES applications(id) ON DELETE CASCADE,
@@ -45,8 +45,8 @@ CREATE TABLE application_addresses (
     UNIQUE (application_id, address)
 );
 
--- Structured send log (spec 7.3). One row per (queue-id, recipient); the
--- log-tailer advances status from queued to a final state.
+-- Structured send log. One row per (queue-id, recipient); the log-tailer
+-- advances status from queued to a final state.
 CREATE TABLE send_log (
     id         INTEGER PRIMARY KEY AUTOINCREMENT,
     queue_id   TEXT,
@@ -63,8 +63,8 @@ CREATE INDEX idx_send_log_queue_id ON send_log (queue_id);
 CREATE INDEX idx_send_log_domain ON send_log (domain);
 CREATE INDEX idx_send_log_created_at ON send_log (created_at);
 
--- Differentiated rate limits per domain/application (spec 7.4). Both the IP
--- binding and the message limit are optional.
+-- Differentiated rate limits per domain/application. Both the IP binding and
+-- the message limit are optional.
 CREATE TABLE rate_limits (
     id             INTEGER PRIMARY KEY AUTOINCREMENT,
     scope          TEXT NOT NULL CHECK (scope IN ('domain', 'application')),