Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

Full server backup (spec 7.5.A): internal/backup produces a tar.gz of all of
/data — a consistent SQLite snapshot via VACUUM INTO, DKIM keys, sasldb2 and a
version manifest; TLS certs (tls/) and the Postfix queue are excluded. Two equal
paths: the panel button (POST /backup, no-store) and the selfpost-backup CLI via
docker exec (spec 11.6). CheckRestore runs before store.Open: a manifest version
mismatch refuses to boot with the image tag to use; a match consumes the
manifest so it only guards the first post-restore boot. Restore is not a
separate branch — Postfix/OpenDKIM regenerate from the restored SQLite as on any
start.

Domain export/import (spec 7.5.B): DomainExport carries the DKIM private key and
each application's working password. SASL secrets are read from sasldb2 via
db_dump (the userPassword property is plaintext) and, on import, re-keyed under
the local realm with saslpasswd2 — so credentials keep working on an instance
with a different hostname, with no DKIM DNS change. Import validates and rolls
back atomically on any failure. db-util (db_dump) is now an explicit image dep.

Verified on the server (selfpost:p9): gofmt/vet/test green; container e2e for
cross-realm domain export/import (SMTP AUTH 235 under the new realm), CLI and
panel backups, same-version restore, and version-mismatch refusal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/app/service_test.go

@@ -221,6 +221,52 @@ func TestServiceRegeneratePassword(t *testing.T) {
 	}
 }
 
+func TestImportApplicationWritesRowAndSASL(t *testing.T) {
+	svc, st, rec, maps := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+
+	if err := svc.ImportApplication(d.ID, "mailer", store.AddressModeList,
+		[]string{"a@example.com"}, "imported-pw"); err != nil {
+		t.Fatalf("ImportApplication: %v", err)
+	}
+	// Registry row and SASL account written with the imported password verbatim.
+	apps, _ := st.ListApplicationsByDomain(d.ID)
+	if len(apps) != 1 || apps[0].Login != "mailer" {
+		t.Fatalf("apps = %+v", apps)
+	}
+	if rec.set["mailer"] != "imported-pw" {
+		t.Errorf("SASL password = %q, want the imported one", rec.set["mailer"])
+	}
+	// Import does not rebuild the sender map itself (the caller batches that).
+	if maps.calls != 0 {
+		t.Errorf("ImportApplication rebuilt the map %d times, want 0", maps.calls)
+	}
+}
+
+func TestImportApplicationRejectsBadInput(t *testing.T) {
+	svc, st, rec, _ := newServiceHarness(t)
+	d := addDomain(t, st, "example.com")
+
+	// Empty password.
+	if err := svc.ImportApplication(d.ID, "mailer", store.AddressModeWildcard, nil, ""); err == nil {
+		t.Error("accepted empty imported password")
+	}
+	// Password with an embedded newline would truncate on the saslpasswd2 stdin.
+	if err := svc.ImportApplication(d.ID, "mailer", store.AddressModeWildcard, nil, "line1\nline2"); err == nil {
+		t.Error("accepted password with control characters")
+	}
+	// Cross-domain address.
+	if err := svc.ImportApplication(d.ID, "mailer", store.AddressModeList, []string{"x@evil.com"}, "pw"); err == nil {
+		t.Error("accepted cross-domain address")
+	}
+	if apps, _ := st.ListApplicationsByDomain(d.ID); len(apps) != 0 {
+		t.Errorf("rows persisted despite validation failure: %+v", apps)
+	}
+	if len(rec.set) != 0 {
+		t.Errorf("SASL accounts written despite validation failure: %v", rec.set)
+	}
+}
+
 func TestServicePurgeDomainSASL(t *testing.T) {
 	svc, st, rec, _ := newServiceHarness(t)
 	d := addDomain(t, st, "example.com")