panel-redesign: no report mailbox for the server as a whole

Follows the design commit before it.

  - internal/dmarc: the ingest allow-list is the report address of each
    domain that is on this host and nothing else;
    DefaultHostedReportAddress and DefaultHostedSuggestion are removed.
    Since 1.7.0 the general mailbox dmarc-reports@<hostname> was open
    while no panel-wide default existed; the three-choice scheme had
    left it open always.
  - The DMARC hub's Ingest box shows the form of a hosted address,
    dmarc-reports+<domain>@<hostname>.
  - guide.md: what port 25 accepts.

Evidence: docs/assets/panel-redesign/evidence/dmarc.png re-shot (the
address form wraps after the plus sign in its column at 1440 px).

  go test -count=1 ./internal/dmarc/... ./internal/web/... ./cmd/panel: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -874,9 +874,10 @@ settings) and nowhere else:
 
 Changing the choice changes the DMARC record to publish; the domain page shows
 the new value. There is no panel-wide or per-user default. Only addresses on
-`SELFPOST_HOSTNAME` are accepted on port 25: the generic
-`dmarc-reports@<hostname>` and any address on that host that a domain has
-chosen.
+`SELFPOST_HOSTNAME` that a domain has chosen are accepted on port 25 - the
+hosted address `dmarc-reports+<domain>@<hostname>` of a domain set to
+*SelfPost hosted*, or a typed address that happens to be on this host. There
+is no mailbox for the server as a whole.
 
 **DNS.** Publish the usual `_dmarc` TXT on each sending domain with
 `rua=mailto:…` pointing at the address the domain shows. Receivers deliver to the