panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.mixfed.ru) and not matching (mixfed.ru), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/templates/domain_detail.html

@@ -1,7 +1,7 @@
 {{define "content"}}
 <h1>{{.Domain.Name}}</h1>
 
-<a class="back" href="/">&larr; All domains</a>
+<a class="back" href="/domains">&larr; All domains</a>
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
 {{if .RateLimitErr}}<div class="flash error">{{.RateLimitErr}}</div>{{end}}
@@ -48,6 +48,36 @@
   documentation). Mail is signed with selector <strong>{{.Domain.DKIMSelector}}</strong>.</p>
 </div>
 
+<div class="card">
+  <h2>DNS status <span class="st st-{{.DNS.Overall}}">{{.DNS.Overall}}</span></h2>
+  <p class="muted">What DNS publishes for <strong>{{.Domain.Name}}</strong> right
+  now, checked against the key this server signs with. Results are cached for a
+  few minutes — after publishing a record, use <em>Re-check</em>.</p>
+
+  <label>DKIM <span class="st st-{{.DNS.DKIM.Status}}">{{.DNS.DKIM.Status}}</span></label>
+  <p class="{{if eq .DNS.DKIM.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DKIM.Detail}}</p>
+  {{if .DNS.DKIM.Records}}<span class="code">{{range .DNS.DKIM.Records}}{{.}}
+{{end}}</span>{{end}}
+
+  <label>SPF <span class="st st-{{.DNS.SPF.Status}}">{{.DNS.SPF.Status}}</span></label>
+  <p class="{{if eq .DNS.SPF.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.SPF.Detail}}</p>
+  {{if .DNS.SPF.Records}}<span class="code">{{range .DNS.SPF.Records}}{{.}}
+{{end}}</span>{{end}}
+  <p class="muted">The SPF check is deliberately shallow: it looks for a
+  mechanism that literally covers this server's address and does not follow
+  <code>include:</code> or <code>redirect=</code>, so a record that authorises
+  the server through an include is reported as “cannot tell”, not as a failure.</p>
+
+  <label>DMARC <span class="st st-{{.DNS.DMARC.Status}}">{{.DNS.DMARC.Status}}</span></label>
+  <p class="{{if eq .DNS.DMARC.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DMARC.Detail}}</p>
+  {{if .DNS.DMARC.Records}}<span class="code">{{range .DNS.DMARC.Records}}{{.}}
+{{end}}</span>{{end}}
+
+  <form class="inline" method="post" action="/domains/{{.Domain.ID}}/dns-recheck">
+    <button type="submit">Re-check</button>
+  </form>
+</div>
+
 <div class="card">
   <h2>Sending server settings</h2>
   <p class="muted">Point the mail client or script at these settings and