review follow-up: close the gaps left by the phase1-6 pass

Verified the tree against docs/plans/code-review-2026-08.md and finished the
tasks that were only partly done, plus two defects the pass introduced.

- bcrypt: the setup account was still hashed at DefaultCost (10). The work
  factor now has one definition, auth.BcryptCost = 12, used everywhere.
- rate limiter: protecting blocked buckets from eviction was unbounded — an
  attacker with many source addresses could grow the map by making each one
  fail its way to blocked. Blocked buckets are now evicted past
  maxBuckets * 4, nearest expiry first, logged once per window. Tests cover
  both halves.
- postqueue: the 5s timeout left the output size unbounded; reads are now
  capped at 4 MiB and report truncation.
- spec references: the ~76 `spec N` citations CHANGELOG [0.5.0] claimed were
  gone are removed from build/, deploy/, the first two migrations and the
  release workflow, with the affected comment paragraphs re-wrapped. Comments
  only; shell/YAML/SQL syntax re-checked.
- schema-migrations.md: schema section was headed v9 with the chain at v10,
  and three links pointed at deleted plan files.
- internal/configsafe: the shared empty/forbidden-character check behind the
  OpenDKIM and Postfix config writers; each writer keeps its own forbidden set.
- dropped the parseDomainRateLimitForm/parseAppRateLimitForm pass-throughs
  left behind by the parser merge (only their own tests still called them).
- plan doc now carries a status table: what shipped, what was already in
  place, what was declined (//go:build linux for the /proc reader) and the
  open CSRF-token question.

Not done, each its own phase: typed template data structs, log/slog, DMARC
service and handler tests, error-page/corrupted-backup tests, backup re-auth.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/handlers/handlers_ratelimit.go

@@ -98,14 +98,6 @@ func parseRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error) {
 	return rateLimitInput{mode: store.RateLimitModeManual, maxMessages: maxMessages, windowSeconds: windowSeconds}, nil
 }
 
-func parseDomainRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error) {
-	return parseRateLimitForm(r, l1Max)
-}
-
-func parseAppRateLimitForm(r *http.Request, l1Max int) (rateLimitInput, error) {
-	return parseRateLimitForm(r, l1Max)
-}
-
 func parseAppAuthIPsForm(r *http.Request) (bool, []string, error) {
 	if err := r.ParseForm(); err != nil {
 		return false, nil, fmt.Errorf("invalid form submission")

internal/web/handlers/handlers_ratelimit_test.go

@@ -8,7 +8,9 @@ import (
 	"testing"
 )
 
-func TestParseDomainRateLimitForm(t *testing.T) {
+// Domain and application limits are parsed by the same function; the form
+// fields and the level-1 backstop are identical for both scopes.
+func TestParseRateLimitForm(t *testing.T) {
 	t.Parallel()
 	form := func(vals url.Values) *http.Request {
 		r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(vals.Encode()))
@@ -16,7 +18,7 @@ func TestParseDomainRateLimitForm(t *testing.T) {
 		return r
 	}
 
-	in, err := parseDomainRateLimitForm(form(url.Values{
+	in, err := parseRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
 		"max_messages":   {"50"},
 		"window_seconds": {"3600"},
@@ -25,44 +27,12 @@ func TestParseDomainRateLimitForm(t *testing.T) {
 		t.Fatalf("valid domain = %+v err=%v", in, err)
 	}
 
-	in, err = parseDomainRateLimitForm(form(url.Values{"max_messages": {""}}), 100)
+	in, err = parseRateLimitForm(form(url.Values{"max_messages": {""}}), 100)
 	if err != nil || !in.clear {
 		t.Fatalf("empty max should clear: %+v err=%v", in, err)
 	}
 
-	_, err = parseDomainRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"max_messages":   {"150"},
-		"window_seconds": {"3600"},
-	}), 100)
-	if err == nil || !strings.Contains(err.Error(), "level-1") {
-		t.Fatalf("over L1 want error, got %v", err)
-	}
-}
-
-func TestParseAppRateLimitForm(t *testing.T) {
-	t.Parallel()
-	form := func(vals url.Values) *http.Request {
-		r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(vals.Encode()))
-		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-		return r
-	}
-
-	in, err := parseAppRateLimitForm(form(url.Values{
-		"mode":           {"manual"},
-		"max_messages":   {"80"},
-		"window_seconds": {"3600"},
-	}), 100)
-	if err != nil || in.maxMessages != 80 {
-		t.Fatalf("valid app limit = %+v err=%v", in, err)
-	}
-
-	in, err = parseAppRateLimitForm(form(url.Values{"max_messages": {""}}), 100)
-	if err != nil || !in.clear {
-		t.Fatalf("empty max should clear: %+v err=%v", in, err)
-	}
-
-	_, err = parseAppRateLimitForm(form(url.Values{
+	_, err = parseRateLimitForm(form(url.Values{
 		"mode":           {"manual"},
 		"max_messages":   {"150"},
 		"window_seconds": {"3600"},
@@ -99,21 +69,21 @@ func TestParseAppAuthIPsForm(t *testing.T) {
 	}
 }
 
-func TestParseDomainRateLimitFormAuto(t *testing.T) {
+func TestParseRateLimitFormAuto(t *testing.T) {
 	t.Parallel()
 	form := func(vals url.Values) *http.Request {
 		r := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(vals.Encode()))
 		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 		return r
 	}
-	in, err := parseDomainRateLimitForm(form(url.Values{
+	in, err := parseRateLimitForm(form(url.Values{
 		"mode":            {"auto"},
 		"auto_multiplier": {"2.5"},
 	}), 100)
 	if err != nil || in.mode != "auto" || in.autoMultiplier != 2.5 {
 		t.Fatalf("auto domain = %+v err=%v", in, err)
 	}
-	_, err = parseDomainRateLimitForm(form(url.Values{
+	_, err = parseRateLimitForm(form(url.Values{
 		"mode":            {"auto"},
 		"auto_multiplier": {"10"},
 	}), 100)

internal/web/handlers/password.go

@@ -1,3 +1,7 @@
 package handlers
 
-const bcryptCost = 12
+import "github.com/mixeme/selfpost/internal/web/auth"
+
+// bcryptCost is the panel-wide password work factor; see auth.BcryptCost for
+// why it lives in one place.
+const bcryptCost = auth.BcryptCost