import: bounds on a domain export (audit W4, W5, W8)

Security audit 2026-10-17, findings W4/W5/W8 (low), stage 4 - all
global-only and self-inflicted, but unbounded:
- W4: ImportKey took any RSA key; a 16 384-bit key makes every signature
  of the domain cost seconds. Now 1024-4096 bits (MinImportKeyBits,
  MaxImportKeyBits); under 1024 Go's parser already refuses.
- W5: an export's applications were unbounded, each a copy of sasldb2 and
  a saslpasswd2 run on the panel's one connection. Now at most 500
  (maxImportApplications).
- W8: an import named as the hostname silently replaced the server's own
  signing key while DNS still held the old record. Now refused with a
  sentence.

Tests: TestImportKeyRefusesAnOversizedKey (4104 bits); the import cases.
Docs: guide § Moving a domain; CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_import_test.go

@@ -71,6 +71,14 @@ func TestDomainImportIsCheckedLikeTheForms(t *testing.T) {
 		{"report address", func(e *domain.DomainExport) { e.DMARCRua = "not an address" },
 			"Invalid report address in export file: "},
 		// As on Domain settings (security audit 2026-10-17, W1).
+		// Security audit 2026-10-17, W8 and W5.
+		{"the server's own name", func(e *domain.DomainExport) { e.Domain = "MAIL.example.org" },
+			"The export is of this server's own name"},
+		{"too many applications", func(e *domain.DomainExport) {
+			for i := 0; i < 500; i++ {
+				e.Applications = append(e.Applications, e.Applications[0])
+			}
+		}, "The export holds 501 applications; an import takes at most 500."},
 		{"report address on the hostname", func(e *domain.DomainExport) { e.DMARCRua = "ops@MAIL.example.org" },
 			"The export's report address is on this server's own name"},
 		{"another domain's hosted address", func(e *domain.DomainExport) { e.DMARCRua = "dmarc-reports+victim.example@mail.example.org" },