import: bounds on a domain export (audit W4, W5, W8)

Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
  of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
  MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
  a saslpasswd2 run on the panel's one connection. Now at most 500
  (maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
  signing key while DNS still held the old record. Now refused with a
  sentence.

Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/transfer_test.go

@@ -1,8 +1,13 @@
 package domain
 
 import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/pem"
 	"errors"
 	"fmt"
+	"strings"
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/store"
@@ -196,3 +201,18 @@ func TestImportRollsBackOnAppFailure(t *testing.T) {
 		t.Error("expected rollback to remove the imported DKIM key")
 	}
 }
+
+// An imported key over 4096 bits is refused (security audit 2026-10-17,
+// W4): every signature of the domain would cost seconds. One under 1024 is
+// refused by the parser already.
+func TestImportKeyRefusesAnOversizedKey(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 4104)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pemKey := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
+	err = NewKeys(t.TempDir()).ImportKey("example.com", "sel", pemKey)
+	if err == nil || !strings.Contains(err.Error(), "a 4104-bit key; SelfPost signs with keys of 1024 to 4096 bits") {
+		t.Errorf("a 4104-bit key: %v", err)
+	}
+}