sender check: connections and messages counted apart; downtime estimated when supervisord is silent (stage 2b)

Following the design commit df96690.

- Two columns (owner, 2026-10-14): sender_check_days.messages (migration
  0009, not deployed) holds the messages deferred mid-message, from
  cleanup's warning; deferred stays the connections smtpd turned away.
  AddSenderCheckDeferred takes which; the counter passes cleanup's as a
  message. The card has "Connections turned away" and "Messages deferred";
  it warns on either within 24 hours (one mark, as before).
- Supervisord silent at start: postfixStarted asks again every 2 s for 30 s
  (postfixState: started, running, known). With no answer the downtime is
  the time since the alive mark - an upper bound - booked with estimated = 1
  (sender_check_days.estimated, MAX over a day); the card prefixes such a
  period's time with "≈ " and its note says what ≈ means. Before, such a
  start counted nothing and the number the owner decides by read low.
- Help topic sender-check and the log topic word for word as the mockup
  (help.go).

Tests: store (connections and messages apart, a period with an estimated
day); logtail (cleanup's warnings are messages); cmd/panel (supervisord
silent: the time since the mark, estimated); view fixture and the Health
page at four columns with ≈; e2e reads the row's two counts (panel down:
connections; panel hung: messages). Schema at 0009 with the columns.

schema-migrations row 9, CHANGELOG [Unreleased], audit plan lines ticked
(two), roadmap 28/62.
Evidence: go vet ./... clean; go test of store, view, cmd/panel ok locally,
logtail but for the Windows-only test; the server run follows before the
push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -805,7 +805,7 @@ order - each stands on the one before.
    flush of the buffer at shutdown would not. Done when the e2e refuses a
    message, kills the panel before the row is written, and finds the row
    after the restart, once. - **Opus**
-- [ ] **Downtime is counted when supervisord does not answer at start**
+- [x] **Downtime is counted when supervisord does not answer at start**
    (owner, 2026-10-13, from the Not done list of from-header-binding). The
    panel asks supervisord once since when Postfix runs
    ([sendercheck.go](../cmd/panel/sendercheck.go), `postfixStarted`); an
@@ -816,7 +816,7 @@ order - each stands on the one before.
    and the day is marked as estimated (a column in `sender_check_days`, the
    next migration), which the card shows. The mark on the card is drawn in
    the mockup with the renamed column above (one `design:` commit). - **Opus**
-- [ ] **The Sender check card names what it counts** (owner, 2026-10-13, from
+- [x] **The Sender check card names what it counts** (owner, 2026-10-13, from
    the Not done list of from-header-binding): the column *Messages deferred*
    becomes *Connections turned away*. Postfix refuses from the connection on
    while the check does not answer, before any message is offered, so a