import: bounds on a domain export (audit W4, W5, W8)

Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
  of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
  MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
  a saslpasswd2 run on the panel's one connection. Now at most 500
  (maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
  signing key while DNS still held the old record. Now refused with a
  sentence.

Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/guide.md

@@ -1159,7 +1159,10 @@ the file is unrecoverable, which is the entire point.
 *Import a domain* takes an encrypted export directly: choose a `.spde` file and
 the password field appears (driven by the file extension in the browser; the
 server also detects the envelope by its magic bytes). A plain `.json` export
-needs no password.
+needs no password. An import is refused, and says why, for a DKIM key outside
+1024-4096 bits, more than 500 applications, a domain named as the server
+itself (its key signs the panel's own mail), and a report address on the
+server's name other than the domain's own hosted one.
 
 A full backup has to be turned back into a plain archive before it can be
 unpacked into `/data`, which the CLI does with the same password: