panel-redesign: Outbound domains, domain, settings, application on the kit

Stage 2, step 3. Written by Sonnet, reviewed by Opus.

  - Six pages named after their mockups: out-domains, out-domain,
    out-domain-settings, out-app, out-app-created, out-domain-delete,
    with typed page data (view/outbound.go, outbound_app.go), fixtures
    and tests. The engine pages dashboard, domain_detail and
    domain_delete are gone with their templates and are off
    legacy_pages.txt. GET .../settings has its own handler.
  - Handlers pass typed data; routes, POST targets, field names,
    validation, authorization (both roles, another tenant's id is a 404)
    and Cache-Control: no-store on the password page are unchanged.
  - Kit, attribute only: Action.Confirm writes data-confirm on a POST
    action's form (panel.js already reads it).
  - test/e2e/panel_client.go scrapes the new markup (copy fields, the
    application row's Edit link). Not run: no Docker here.

Fixes found on the way
  - Report address of a domain that follows another user's default: the
    select had one "inherit" option, selected, so saving the form
    untouched moved the domain to whoever saved it. It now offers that
    user's default as "keep" (selected, saves nothing) and "My default
    instead" as the change, as the mockup draws it; "keep" on a domain
    that does not follow someone else is refused.
  - panel.js: syncShowWhen stopped at the first matching rule, so the
    auto-limit fields were never toggled with the limit mode. Every
    matching rule applies now.

Differences from the mockups, for the owner:
  - application rows carry Edit only. New password and Delete are POSTs,
    and the kit has no link-styled POST control for a table row; both are
    in the application page's head with a confirmation. Drawing them in
    the row needs a design: change (as Sign out was);
  - the application login is read-only on edit (the handler refuses a
    rename); the submit says Create application on the empty form;
  - multiplier bounds are the store's 1.5-5, default 2.5;
  - "Recalculate" buttons exist where the stored limit is automatic;
  - a domain administrator has no add box and no Delete; Delete domain is
    global-only on the domain page and on settings;
  - a fourth record, Report authorization, appears when the report
    address is on another domain; record states missing / weak / not
    checked are tags with the explanation under the value;
  - refusals are the kit flash above the first box, and those of the
    settings forms now show on the settings page; successful saves still
    redirect to the domain page;
  - the export checkbox is ticked by default, as drawn.

Evidence
  - docs/assets/panel-redesign/evidence/out-domains.png, out-domain.png,
    out-domain-settings.png, out-app.png, out-app-created.png,
    out-domain-delete.png: 1440 px wide, headless Edge, real templates
    served locally with their fixtures - NOT from the container (no
    Docker on this machine). Taken before the report-address fix, which
    does not change what the fixture renders.
  - panel/audit.js on the six pages at 1440 and 1280 (text inside
    [hidden] blocks skipped): 866 texts checked, problems: [].
  - go test -count=1 ./internal/web/...
      ok  internal/web
      ok  internal/web/auth
      ok  internal/web/handlers
      ok  internal/web/validate
      ok  internal/web/view

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

test/e2e/panel_client.go

@@ -161,7 +161,7 @@ func (c *panelClient) dkimRecord(domainID string) (name, value string, err error
 	if !ok {
 		return "", "", fmt.Errorf("could not find DKIM record name on domain page")
 	}
-	value, ok = extractCodeRow(body, "Value")
+	value, ok = extractCodeRow(body, "Value to publish")
 	if !ok {
 		return "", "", fmt.Errorf("could not find DKIM record value on domain page")
 	}
@@ -236,18 +236,17 @@ func (c *panelClient) status() (*http.Response, error) {
 	return resp, err
 }
 
-// applicationID scrapes an application's numeric id off its block on the domain
-// page, keyed by login — needed to build /applications/{id}/ratelimit, which the
-// add-application response (just the login/password) does not carry. The id is
-// taken from the first action posted under that login, whichever it is, so
-// reordering the block's controls does not break the scrape; only the login
-// heading itself is anchored on.
+// applicationID scrapes an application's numeric id off its row of the domain
+// page, keyed by login — needed to build the application's own address
+// (/outbound/domains/{id}/applications/{aid}), which the add-application
+// response (just the login/password) does not carry. The id is taken from the
+// row's Edit link, so only the login cell itself is anchored on.
 func (c *panelClient) applicationID(domainID, login string) (string, error) {
 	_, body, err := c.get("/outbound/domains/" + domainID)
 	if err != nil {
 		return "", err
 	}
-	pattern := `(?s)<p class="app-login">` + regexp.QuoteMeta(login) + `</p>.*?/applications/(\d+)/`
+	pattern := `(?s)<strong>` + regexp.QuoteMeta(login) + `</strong></td>.*?/applications/(\d+)"`
 	m := regexp.MustCompile(pattern).FindStringSubmatch(body)
 	if m == nil {
 		return "", fmt.Errorf("could not find application id for login %q", login)
@@ -255,18 +254,24 @@ func (c *panelClient) applicationID(domainID, login string) (string, error) {
 	return m[1], nil
 }
 
-// extractCodeRow scrapes the value of a "<label>LABEL</label> ... <span
-// class=\"code\">VALUE</span>" pair from a rendered panel page (see
-// internal/web/templates/domain_detail.html). It is deliberately anchored to
-// the label text rather than position, so it survives unrelated template
-// reordering. html/template's escaper is conservative about which characters
-// it entity-encodes in text nodes — a DKIM value's base64 "+" comes back as
-// "&#43;" — so the match is HTML-unescaped before returning.
+// extractCodeRow scrapes the value of a copy field — a "<label class=\"label\">
+// LABEL</label>" followed by its read-only input or textarea (the panel's
+// copy_field partial, internal/web/view/templates/components.html) — from a
+// rendered panel page. It is deliberately anchored to the label text rather
+// than position, so it survives unrelated template reordering. html/template's
+// escaper is conservative about which characters it entity-encodes — a DKIM
+// value's base64 "+" comes back as "&#43;" — so the match is HTML-unescaped
+// before returning.
 func extractCodeRow(body, label string) (string, bool) {
-	pattern := `<label>` + regexp.QuoteMeta(label) + `</label>\s*<div class="code-row">\s*<span class="code">([^<]*)</span>`
+	pattern := `<label class="label">` + regexp.QuoteMeta(label) + `</label>\s*<div class="field has-addons"><div class="control is-expanded">` +
+		`(?:<input class="input" readonly value="([^"]*)">|<textarea class="textarea" rows="\d+" readonly>([^<]*)</textarea>)`
 	m := regexp.MustCompile(pattern).FindStringSubmatch(body)
 	if m == nil {
 		return "", false
 	}
-	return html.UnescapeString(strings.TrimSpace(m[1])), true
+	value := m[1]
+	if value == "" {
+		value = m[2]
+	}
+	return html.UnescapeString(strings.TrimSpace(value)), true
 }