panel-redesign: paths follow the menu; Account and Server settings split

Stage 1, step 3 (plan § Routes). BREAKING: every panel URL changes and the
old paths are removed without redirects.

Routes (web.go)
  - /status -> /overview; /domains -> /outbound/domains with the domain's
    settings actions under .../settings/ (reports, ratelimit, export);
    /deliveries -> /outbound/log; /mail-queue -> /outbound/queue; /dmarc ->
    /outbound/dmarc; /inbound -> /inbound/domains; /system-log ->
    /server/log; /backup -> /server/backup (import under it); /users ->
    /server/users; recheck and reload under /server/health/.
  - One fragment name: <page>/fragment everywhere.
  - Everything under /server/ is registered through server(), which wraps
    the handler in globalOnly: the subtree is guarded once, where a new
    route cannot forget it. Handlers keep their own requireGlobal.
  - GET / leads to /overview, /outbound/domains or /inbound/domains.
  - The /account -> /settings redirect is gone with /settings.

Account and Server > Settings
  - handlers_account.go: GET /account and three POSTs - profile (username,
    e-mail; no password asked, as designed), password (current password,
    rate-limited like a sign-in, signs out other sessions), dmarc (the
    user's default: hosted / account / custom / none, each validated).
    This replaces step 1's bridge through the old Settings form.
  - handlers_settings.go is the instance's page only: log retention and the
    read-only rate limits, global role.
  - One legacy template serves both pages by a flag until stage 2 gives each
    its own: a new legacy page cannot be added to the ratchet.

Still to come inside stage 1, and why @routes stays on the ratchet:
  - step 4: the application routes (one POST, under the domain);
  - step 5: GET /server/health.
With @routes removed by hand TestRoutesFollowNavigation reports exactly
those and nothing else - no template links to a path the router lacks.

Old templates, tests and the e2e client are retargeted. The e2e module was
edited but not run here (no Docker, and its dependency could not be
downloaded on this machine).

Tests: Account (page, profile, password, DMARC default in every mode, a
domain administrator's own row only), Server settings (saved without a
password, range, global only), the /server/ subtree answered 404 by the
router for a domain administrator with All on both lists and for no
principal.

go test ./...  green except the two Windows-only failures in internal/domain
and internal/logtail.

Roadmap 13/27.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -48,19 +48,30 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   tenant's domain, a missing one and a user with no inbound reach all get the
   same 404. A menu group with nothing assigned is absent, and `/` leads an
   inbound-only administrator to Inbound.
+- panel-redesign (stage 1): **Account** (`/account`, every role) and
+  **Server › Settings** (`/server/settings`, global role) replace the one
+  Settings page. Account has three forms, each its own POST: profile
+  (username, e-mail), password, and the default DMARC report address
+  (SelfPost hosted, my account e-mail, another address, none). Saving the
+  profile no longer asks for the password; changing the password still does.
 
 ### Changed
 
+- **Breaking — every panel URL changed.** A path now reads like the menu
+  (`/overview`, `/outbound/…`, `/inbound/…`, `/server/…`, `/account`); the
+  old paths are removed, not redirected — see *Removed*. Polled fragments all
+  answer `<page>/fragment`. Everything under `/server/` is guarded for the
+  global role where the routes are registered, in addition to each handler's
+  own check. The application routes and Server › Health follow in the next
+  two steps.
 - **Breaking — the database starts from zero.** The 1.x migration chain
   (`0001`–`0010`) is replaced by one baseline, `0001_init.sql`. A 1.x
   `/data/selfpost.db` is refused at start-up with an explicit error and left
   untouched; nothing is migrated. A domain can be carried over with its
   export file.
 - The panel role `domain_admin` is stored as `domain`.
-- Until the Account page replaces it, the old Settings form's "default report
-  address" field sets the account e-mail and switches the user's DMARC
-  default between that e-mail and none; a domain's "Same as Settings" makes
-  it follow the user who chose it.
+- On the old domain page, "Same as Settings" makes the domain follow the
+  default report address of the user who chose it.
 - The old panel is untouched on screen but steps aside in the tree: its
   stylesheet is `legacy.css` and its layout `layout_legacy.html` until the
   last old page is restyled. The 2.0 menu paths in the new shell do not
@@ -70,6 +81,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Removed
 
+- Old panel paths, GET and POST alike, without redirects: `/status`,
+  `/status/fragment`, `/status/recheck`, `/reload`, `/domains` and everything
+  under it (`/domains/import`, `/domains/{id}`, `…/dns-recheck`, `…/delete`,
+  `…/ratelimit`, `…/ratelimit/recalc`, `…/dmarc`, `…/export`), `/inbound` and
+  `/inbound/{id}/…`, `/dmarc`, `/dmarc/reports/{id}`, `/dmarc/domains/{id}`,
+  `/deliveries`, `/deliveries/rows`, `/deliveries/{id}`, `/mail-queue`,
+  `/mail-queue/body`, `/system-log`, `/system-log/body`, `/backup`, `/users`
+  and everything under it, `/settings`, and the `/account` → `/settings`
+  redirect.
 - The instance setting `dmarc_report_email` (a mirror of the global user's
   profile field) and the unused `rate_limits.allowed_ips` column.