domains: a domain's DMARC reports are deleted with it (audit A5/W2)

Security audit 2026-10-17, finding A5/W2 (low), stage 1; the mockup is
7effc98. dmarc_reports belong to a domain by name, outlive the domain (no
FK), and a domain deleted and added again handed its old reports to
whoever it was assigned to then - the logs were moved to ids in 2.5.0 for
exactly this case, reports were not.

The cheap form of the plan: store.DeleteDomain deletes the domain's
reports (their records by the table's cascade) in the same transaction as
the domain. The confirmation page says so when the domain has reports
("delete the 12 DMARC reports received for it;"), counted by the new
store.CountDMARCReports; NewOutDomainDelete takes the count.

Tests: TestDeletingADomainDeletesItsReports (the domain added again has
none, another domain keeps its report and record, a second delete is
ErrDomainNotFound); TestOutDomainDeleteNamesWhatGoesWithIt with 12, 1 and
0 reports.

Docs: security.md § Roles; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -745,9 +745,10 @@ the argument.
   2026-10-17:* the live registry holds two hosted addresses and no custom
   one on the hostname; TestCustomReportAddressOnTheHostnameIsRefused, the
   untagged cases in TestIngestMessageRejectsTagMismatch.
-- [ ] **A5/W2.** Delete a domain's reports in `domain.Service.Delete` (the
+- [x] **A5/W2.** Delete a domain's reports in `domain.Service.Delete` (the
   cheap form); security.md § Roles says reports go with the domain. —
-  **Sonnet**, 0.5 h. (The `domain_id` form is better and 2 h; take it if
+  **Sonnet**, 0.5 h. *Done 2026-10-17:* in `store.DeleteDomain`, one
+  transaction with the domain; TestDeletingADomainDeletesItsReports. (The `domain_id` form is better and 2 h; take it if
   stage 1 is split across two sittings.)
 - [ ] **W3.** A mutex around `Resync`'s read + write + reload. — **Sonnet**,
   0.5 h.