import: bounds on a domain export (audit W4, W5, W8)

Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
  of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
  MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
  a saslpasswd2 run on the panel's one connection. Now at most 500
  (maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
  signing key while DNS still held the old record. Now refused with a
  sentence.

Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -812,9 +812,11 @@ the argument.
   real changes, each of which Postfix must see; twenty re-checks in 15
   minutes per user, then the cached result. TestARebuildThatChangesNothingDoesNotReload,
   TestDNSRechecksArePerUser.
-- [ ] **W4/W5/W8.** Key size 1024-4096 on import; ≤ 500 applications per
+- [x] **W4/W5/W8.** Key size 1024-4096 on import; ≤ 500 applications per
   export; an import named as the hostname refused with a sentence. —
-  **Sonnet**, 1.5 h.
+  **Sonnet**, 1.5 h. *Done 2026-10-17:*
+  TestImportKeyRefusesAnOversizedKey and the import cases (a key under
+  1024 bits the parser already refuses).
 - [ ] **S4.** rspamd pin → `4.2.x` after reading `milter_headers`/`multimap`
   against the 4.x docs and one e2e run (`inbound_upstream_test`,
   `antispam_test`); `cap_drop: [ALL]`, `no-new-privileges`, `pids_limit` on