panel-redesign: no report mailbox for the server as a whole

Follows the design commit before it.

  - internal/dmarc: the ingest allow-list is the report address of each
    domain that is on this host and nothing else;
    DefaultHostedReportAddress and DefaultHostedSuggestion are removed.
    Since 1.7.0 the general mailbox dmarc-reports@<hostname> was open
    while no panel-wide default existed; the three-choice scheme had
    left it open always.
  - The DMARC hub's Ingest box shows the form of a hosted address,
    dmarc-reports+<domain>@<hostname>.
  - guide.md: what port 25 accepts.

Evidence: docs/assets/panel-redesign/evidence/dmarc.png re-shot (the
address form wraps after the plus sign in its column at 1440 px).

  go test -count=1 ./internal/dmarc/... ./internal/web/... ./cmd/panel: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -133,6 +133,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `unix:/path`, one second at most, nothing sent). A filter that does not
   answer is an error with `INBOUND_ANTISPAM_MILTER_ACTION=tempfail` - inbound
   mail is deferred - and a warning otherwise - mail goes through unfiltered.
+- **Port 25 no longer accepts `dmarc-reports@<hostname>`**, the report
+  mailbox of the server as a whole. Only an address a domain has chosen is
+  accepted: its hosted address `dmarc-reports+<domain>@<hostname>`, or a
+  typed address that is on this host. A domain whose published `rua=` still
+  names the general mailbox must be set to *SelfPost hosted* and its DMARC
+  record republished (owner, 2026-10-10).
 - panel-redesign (design, stage 3): **New password** and **Delete** are in
   each row of a domain's Applications table again, as POST forms that look
   like the links beside them.