panel-redesign: the application form is one POST, under its domain

Stage 1, step 4 (plan § Routes).

Service (internal/app)
  - Settings{Mode, Addresses, AuthIPRestrict, AuthAllowedIPs, Limit} is what
    the form holds besides the login. CreateWithSettings creates the
    application with all of it and removes it again if a later write fails;
    SaveSettings validates the sender rule first and, if a later write
    fails, puts back what it had already changed. The form produces a whole
    application or leaves things as they were.
  - Limit.Mode "" is "use the domain limit"; auto takes its ceiling from a
    recalculation the caller supplies.

Routes and handlers
  - GET, POST /outbound/domains/{id}/applications/new
    GET, POST /outbound/domains/{id}/applications/{aid}
    POST .../{aid}/password, .../{aid}/ratelimit/recalc, .../{aid}/delete
    replace POST /domains/{id}/applications and the six /applications/{aid}/*
    routes. lookupDomainApplication answers 404 when the application is not
    in the domain named by the path - also when the caller may open that
    domain.
  - A generated password is the response to its POST only (no GET path) and
    is sent with Cache-Control: no-store.
  - The login is not renamed by the form; a changed login is a 400.

Old domain page: the three per-application forms (mode, IP restriction,
limit) are one form with one Save; "Remove limit" became the "Use the domain
limit" choice. The e2e client follows (edited, not run here).

Tests: service - create and save in every limit mode, and all-or-nothing on
a refused sender rule, a failed recalculation and a failed sender-map
rebuild; handlers - the form's parsing, one POST creating sender + IPs +
limit, four kinds of refused form creating nothing, save, the no-store
header on both password pages, and five application routes against another
tenant's application addressed through its own domain and through the
caller's.

With @routes removed by hand TestRoutesFollowNavigation now reports only
GET /server/health (step 5).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 14/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -54,6 +54,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   (username, e-mail), password, and the default DMARC report address
   (SelfPost hosted, my account e-mail, another address, none). Saving the
   profile no longer asks for the password; changing the password still does.
+- panel-redesign (stage 1): the application form is one POST. Who the
+  application may send as, its client-IP allow-list and its rate limit
+  ("use the domain limit", manual or auto) are validated together and saved
+  together or not at all — also at creation, so an application can be added
+  with its limit already in place. The page that shows a generated password
+  is the response to its POST only and is sent with `Cache-Control: no-store`.
 
 ### Changed
 
@@ -62,8 +68,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   old paths are removed, not redirected — see *Removed*. Polled fragments all
   answer `<page>/fragment`. Everything under `/server/` is guarded for the
   global role where the routes are registered, in addition to each handler's
-  own check. The application routes and Server › Health follow in the next
-  two steps.
+  own check. An application is addressed under its domain
+  (`/outbound/domains/{id}/applications/{aid}`), and an application id that
+  does not belong to the domain in the path is a 404.
 - **Breaking — the database starts from zero.** The 1.x migration chain
   (`0001`–`0010`) is replaced by one baseline, `0001_init.sql`. A 1.x
   `/data/selfpost.db` is refused at start-up with an explicit error and left
@@ -89,7 +96,9 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `/deliveries`, `/deliveries/rows`, `/deliveries/{id}`, `/mail-queue`,
   `/mail-queue/body`, `/system-log`, `/system-log/body`, `/backup`, `/users`
   and everything under it, `/settings`, and the `/account` → `/settings`
-  redirect.
+  redirect; `POST /domains/{id}/applications` and `/applications/{aid}/mode`,
+  `/authips`, `/ratelimit`, `/ratelimit/recalc`, `/password`, `/delete` — the
+  three separate saves of an application are one form now.
 - The instance setting `dmarc_report_email` (a mirror of the global user's
   profile field) and the unused `rate_limits.allowed_ips` column.