import: bounds on a domain export (audit W4, W5, W8)

Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
  of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
  MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
  a saslpasswd2 run on the panel's one connection. Now at most 500
  (maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
  signing key while DNS still held the old record. Now refused with a
  sentence.

Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -1159,7 +1159,10 @@ the file is unrecoverable, which is the entire point.
 *Import a domain* takes an encrypted export directly: choose a `.spde` file and
 the password field appears (driven by the file extension in the browser; the
 server also detects the envelope by its magic bytes). A plain `.json` export
-needs no password.
+needs no password. An import is refused, and says why, for a DKIM key outside
+1024-4096 bits, more than 500 applications, a domain named as the server
+itself (its key signs the panel's own mail), and a report address on the
+server's name other than the domain's own hosted one.
 
 A full backup has to be turned back into a plain archive before it can be
 unpacked into `/data`, which the CLI does with the same password:

docs/security-audit-2026-10-17.md

@@ -812,9 +812,11 @@ the argument.
   real changes, each of which Postfix must see; twenty re-checks in 15
   minutes per user, then the cached result. TestARebuildThatChangesNothingDoesNotReload,
   TestDNSRechecksArePerUser.
-- [ ] **W4/W5/W8.** Key size 1024-4096 on import; ≤ 500 applications per
+- [x] **W4/W5/W8.** Key size 1024-4096 on import; ≤ 500 applications per
   export; an import named as the hostname refused with a sentence. —
-  **Sonnet**, 1.5 h.
+  **Sonnet**, 1.5 h. *Done 2026-10-17:*
+  TestImportKeyRefusesAnOversizedKey and the import cases (a key under
+  1024 bits the parser already refuses).
 - [ ] **S4.** rspamd pin → `4.2.x` after reading `milter_headers`/`multimap`
   against the 4.x docs and one e2e run (`inbound_upstream_test`,
   `antispam_test`); `cap_drop: [ALL]`, `no-new-privileges`, `pids_limit` on