panel-redesign: the application form is one POST, under its domain

Stage 1, step 4 (plan § Routes).

Service (internal/app)
  - Settings{Mode, Addresses, AuthIPRestrict, AuthAllowedIPs, Limit} is what
    the form holds besides the login. CreateWithSettings creates the
    application with all of it and removes it again if a later write fails;
    SaveSettings validates the sender rule first and, if a later write
    fails, puts back what it had already changed. The form produces a whole
    application or leaves things as they were.
  - Limit.Mode "" is "use the domain limit"; auto takes its ceiling from a
    recalculation the caller supplies.

Routes and handlers
  - GET, POST /outbound/domains/{id}/applications/new
    GET, POST /outbound/domains/{id}/applications/{aid}
    POST .../{aid}/password, .../{aid}/ratelimit/recalc, .../{aid}/delete
    replace POST /domains/{id}/applications and the six /applications/{aid}/*
    routes. lookupDomainApplication answers 404 when the application is not
    in the domain named by the path - also when the caller may open that
    domain.
  - A generated password is the response to its POST only (no GET path) and
    is sent with Cache-Control: no-store.
  - The login is not renamed by the form; a changed login is a 400.

Old domain page: the three per-application forms (mode, IP restriction,
limit) are one form with one Save; "Remove limit" became the "Use the domain
limit" choice. The e2e client follows (edited, not run here).

Tests: service - create and save in every limit mode, and all-or-nothing on
a refused sender rule, a failed recalculation and a failed sender-map
rebuild; handlers - the form's parsing, one POST creating sender + IPs +
limit, four kinds of refused form creating nothing, save, the no-store
header on both password pages, and five application routes against another
tenant's application addressed through its own domain and through the
caller's.

With @routes removed by hand TestRoutesFollowNavigation now reports only
GET /server/health (step 5).

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 14/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_delegation_test.go

@@ -272,7 +272,8 @@ func TestInboundListWithNothingLeftIs404(t *testing.T) {
 }
 
 // The outbound side of the same rule, route by route: a domain administrator
-// asking for another tenant's sending domain or application by id gets 404,
+// asking for another tenant's sending domain or application by id gets 404 —
+// also when the application is addressed through the caller's own domain —
 // and so does a user whose reach is inbound only.
 func TestOutboundRoutesAnswerAnotherTenant404(t *testing.T) {
 	h, domains := serverWithTwoDomains(t)
@@ -291,25 +292,35 @@ func TestOutboundRoutesAnswerAnotherTenant404(t *testing.T) {
 	inboundOnly := userWith(t, h.store, "inbound-only", store.RoleDomain, store.Reach{InboundDomainIDs: []int64{in.ID}})
 
 	did := map[string]string{"id": idStr(second.ID)}
-	aid := map[string]string{"aid": idStr(foreignApp.ID)}
-	routes := []struct {
+	// Another tenant's application, addressed through its own domain — and
+	// through the caller's own domain, which it is not in: the URL names a
+	// domain the caller may open, but the application still is not theirs.
+	aid := map[string]string{"id": idStr(second.ID), "aid": idStr(foreignApp.ID)}
+	smuggled := map[string]string{"id": idStr(first.ID), "aid": idStr(foreignApp.ID)}
+	type outRoute struct {
 		method, target string
 		handler        http.HandlerFunc
 		pathValues     map[string]string
-	}{
+	}
+	routes := []outRoute{
 		{"GET", "/outbound/domains/{id}", h.HandleDomainDetail, did},
+		{"GET", "/outbound/domains/{id}/settings", h.HandleDomainDetail, did},
 		{"POST", "/outbound/domains/{id}/dns-recheck", h.HandleDomainDNSRecheck, did},
-		{"POST", "/outbound/domains/{id}/applications", h.HandleAddApplication, did},
 		{"POST", "/outbound/domains/{id}/settings/ratelimit", h.HandleDomainRateLimit, did},
 		{"POST", "/outbound/domains/{id}/settings/ratelimit/recalc", h.HandleDomainRateLimitRecalc, did},
 		{"POST", "/outbound/domains/{id}/settings/reports", h.HandleDomainDMARC, did},
 		{"POST", "/outbound/domains/{id}/settings/export", h.HandleExportDomain, did},
-		{"POST", "/applications/{aid}/mode", h.HandleUpdateAppMode, aid},
-		{"POST", "/applications/{aid}/authips", h.HandleAppAuthIPs, aid},
-		{"POST", "/applications/{aid}/password", h.HandleRegenPassword, aid},
-		{"POST", "/applications/{aid}/ratelimit", h.HandleAppRateLimit, aid},
-		{"POST", "/applications/{aid}/ratelimit/recalc", h.HandleAppRateLimitRecalc, aid},
-		{"POST", "/applications/{aid}/delete", h.HandleDeleteApplication, aid},
+		{"GET", "/outbound/domains/{id}/applications/new", h.HandleApplicationNew, did},
+		{"POST", "/outbound/domains/{id}/applications/new", h.HandleApplicationCreate, did},
+	}
+	for _, pv := range []map[string]string{aid, smuggled} {
+		routes = append(routes,
+			outRoute{"GET", "/outbound/domains/{id}/applications/{aid}", h.HandleApplicationEdit, pv},
+			outRoute{"POST", "/outbound/domains/{id}/applications/{aid}", h.HandleApplicationSave, pv},
+			outRoute{"POST", "/outbound/domains/{id}/applications/{aid}/password", h.HandleRegenPassword, pv},
+			outRoute{"POST", "/outbound/domains/{id}/applications/{aid}/ratelimit/recalc", h.HandleAppRateLimitRecalc, pv},
+			outRoute{"POST", "/outbound/domains/{id}/applications/{aid}/delete", h.HandleDeleteApplication, pv},
+		)
 	}
 	for _, rt := range routes {
 		for who, p := range map[string]*auth.Principal{