Phase 3: sending domains + per-domain OpenDKIM signing

Add/list/delete of sending domains with per-domain DKIM keys and the
OpenDKIM tables that drive signing (spec 6, 7.2.2-4, 7.2.10).

internal/domain:
- Pure-Go RSA-2048 keygen; PKCS#1 PEM written atomically at 0640; the
  published DNS TXT record is derived from the key on disk (single source
  of truth) rather than persisted. No os/exec for key generation.
- KeyTable/SigningTable fully regenerated from the registry on every
  add/delete (idempotent), written atomically; SigningTable via refile:
  with *@domain, KeyTable with absolute key paths. Table writer refuses
  any unsafe character as a backstop (spec 7.6.4).
- Reload without root: the unprivileged panel signals OpenDKIM through
  supervisord (`supervisorctl signal USR1 opendkim`, fixed args, no
  shell, no user input — spec 7.6.3). An existing key is reused, never
  overwritten, so re-adding a domain keeps its published DNS valid.
- Service orchestrates registry -> key -> table rebuild -> reload, with
  rollback of the row if a downstream step fails; delete cascades apps
  via the DB FK and removes the key + table entries.

Infra:
- Shared `selfpost` group bridges panel (writes keys) and opendkim
  (reads them); /data/opendkim is setgid so panel-created files inherit
  the group, keys are 0640, RequireSafeKeys is disabled by design.
- opendkim.conf moves from verify-only (Mode v) to signing (Mode s).
- entrypoint.sh normalises the DKIM tree on every start (ownership,
  setgid, perms, empty tables before opendkim starts) — self-healing
  after a restore.
- supervisord control socket opened to the `selfpost` group so the panel
  can request the reload.

web/store:
- Strict domain-name validation (whitelist [a-z0-9.-], DNS shape, >=2
  labels), lower-case normalisation (spec 7.6.2).
- Domain queries with application counts; delete relies on ON DELETE
  CASCADE. Dashboard lists domains + add form; domain page shows the
  DKIM record; a dedicated confirm page warns about the app cascade
  before deletion (spec 7.2.4); manual reload button (spec 7.2.12,
  OpenDKIM side; Postfix reload lands in Phase 5).
- Authenticated routes moved to a sub-mux using Go 1.22 method/wildcard
  patterns.

Tests: validateDomain, DKIM keygen/record roundtrip, table rendering +
injection-safety, key reuse, store cascade. Verified on the dev server:
gofmt/vet/test green, image builds, container e2e (add/delete a domain,
DKIM record shown, OpenDKIM reads panel keys and reloads, keys and
tables persist across a restart).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/domain/dkim.go

@@ -0,0 +1,127 @@
+// Package domain owns SelfPost's sending-domain model: per-domain DKIM key
+// generation, the OpenDKIM KeyTable/SigningTable that drive signing, and the
+// orchestration that keeps the SQLite registry, the on-disk keys and OpenDKIM
+// in agreement (spec 4.1, 6). Key material lives under /data so it survives
+// container restarts (spec 6.1, 9).
+package domain
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/pem"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// dkimKeyBits is the RSA key size for DKIM signing keys. 2048 is the DKIM
+// interoperability sweet spot: strong, and short enough that the published
+// public key still fits comfortably in a DNS TXT record.
+const dkimKeyBits = 2048
+
+// generateDKIMKey creates a fresh RSA private key for signing a domain.
+func generateDKIMKey() (*rsa.PrivateKey, error) {
+	key, err := rsa.GenerateKey(rand.Reader, dkimKeyBits)
+	if err != nil {
+		return nil, fmt.Errorf("generate dkim key: %w", err)
+	}
+	return key, nil
+}
+
+// writePrivateKeyPEM writes key to path as a PKCS#1 "RSA PRIVATE KEY" PEM,
+// atomically and group-readable (0640). The file is owned by the panel user and
+// read by OpenDKIM through the shared `selfpost` group (see build/opendkim.conf
+// and entrypoint.sh); the parent directory carries setgid so the group is
+// inherited. The write is atomic (temp file + rename) so OpenDKIM never observes
+// a half-written key.
+func writePrivateKeyPEM(path string, key *rsa.PrivateKey) error {
+	block := &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(key),
+	}
+	return writeFileAtomic(path, pem.EncodeToMemory(block), 0o640)
+}
+
+// loadPrivateKeyPEM reads and parses a PKCS#1 RSA private key written by
+// writePrivateKeyPEM. It is used to recompute the public DNS record on demand,
+// keeping the private key file the single source of truth (spec 7.2.10).
+func loadPrivateKeyPEM(path string) (*rsa.PrivateKey, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	block, _ := pem.Decode(data)
+	if block == nil || block.Type != "RSA PRIVATE KEY" {
+		return nil, fmt.Errorf("dkim key %s: not a PKCS#1 RSA private key", path)
+	}
+	key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, fmt.Errorf("parse dkim key %s: %w", path, err)
+	}
+	return key, nil
+}
+
+// DKIMRecord is the DNS TXT record a user must publish for a domain (spec 7.2.10).
+type DKIMRecord struct {
+	// Name is the record's host, e.g. "selfpost._domainkey.example.com".
+	Name string
+	// Value is the TXT payload, e.g. "v=DKIM1; h=sha256; k=rsa; p=MIIB...".
+	Value string
+}
+
+// dkimRecord builds the published DKIM DNS record for a public key. The value
+// mirrors what opendkim-genkey emits: v=DKIM1, sha256, RSA, and the public key
+// as base64-encoded SubjectPublicKeyInfo (PKIX) DER.
+func dkimRecord(selector, domainName string, pub *rsa.PublicKey) (DKIMRecord, error) {
+	der, err := x509.MarshalPKIXPublicKey(pub)
+	if err != nil {
+		return DKIMRecord{}, fmt.Errorf("marshal dkim public key: %w", err)
+	}
+	p := base64.StdEncoding.EncodeToString(der)
+	return DKIMRecord{
+		Name:  fmt.Sprintf("%s._domainkey.%s", selector, domainName),
+		Value: fmt.Sprintf("v=DKIM1; h=sha256; k=rsa; p=%s", p),
+	}, nil
+}
+
+// writeFileAtomic writes data to path via a temp file in the same directory
+// followed by a rename, so readers only ever see the complete old or new file.
+// It is the single safe-write primitive for DKIM keys and OpenDKIM tables
+// (spec 7.6.4).
+func writeFileAtomic(path string, data []byte, perm os.FileMode) error {
+	dir := filepath.Dir(path)
+	tmp, err := os.CreateTemp(dir, ".tmp-*")
+	if err != nil {
+		return fmt.Errorf("create temp in %s: %w", dir, err)
+	}
+	tmpName := tmp.Name()
+	cleanup := true
+	defer func() {
+		if cleanup {
+			_ = os.Remove(tmpName)
+		}
+	}()
+
+	if _, err := tmp.Write(data); err != nil {
+		tmp.Close()
+		return fmt.Errorf("write temp %s: %w", tmpName, err)
+	}
+	if err := tmp.Chmod(perm); err != nil {
+		tmp.Close()
+		return fmt.Errorf("chmod temp %s: %w", tmpName, err)
+	}
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		return fmt.Errorf("sync temp %s: %w", tmpName, err)
+	}
+	if err := tmp.Close(); err != nil {
+		return fmt.Errorf("close temp %s: %w", tmpName, err)
+	}
+	if err := os.Rename(tmpName, path); err != nil {
+		return fmt.Errorf("rename %s -> %s: %w", tmpName, path, err)
+	}
+	cleanup = false
+	return nil
+}