chore/docs: move to GitHub as the single home; drop archived-spec references

Codeberg is being retired as the project's public site, so every reference now
points at GitHub. That includes the Go module path (codeberg.org/mix/selfpost →
github.com/mixeme/selfpost): leaving an import path on a host that is going
away would break `go get` and `go install`, so this is not only a docs change.
Touches go.mod, test/e2e/go.mod, all imports, Makefile MODULE, the -ldflags
version stamp in build/Dockerfile and docs/development.md, the licence headers
in the SVG/HTML assets, and README (no more primary/mirror pair).

Comments no longer cite the archived specification. "spec 7.6.1", "spec 5.1"
and friends pointed into docs/archive/specification-v1.0.md, which is marked as
not a source of truth; each is now a reference to the live document that owns
the subject — architecture.md (with section), product.md, security.md or the
README. The review only asked for the 7.x refs (code-review.md § 4), but 4/5/6/
8/9 had the same defect, so they went too. Comments only, no behaviour change.

Also closes the remaining review items: architecture.md gained a Code layers
section with the layer diagram (A2), and TestParseDelivery gained the exotic
mail.log cases (§ 3).

Fixes a bug that last test found: the delivery-line pattern matched status=
greedily, taking the *last* occurrence on the line. Postfix appends the remote
server's reply verbatim, so a rejection whose reply quoted "status=sent" was
filed as a delivered message in the send log. It now takes the first status=
after the recipient, which is the real field.

R7 (CONTRIBUTING.md) moved to roadmap 2.x — one developer, no external PR flow,
so the file would have no audience yet. R1 (compose image tag) and the git tag
stay in roadmap § v1.x as the release-commit steps.

gofmt/go vet clean on both modules; go test ./... green except the three known
Windows-only failures (file perms, backslash paths, renaming an open file).
Not exercised on the dev server — no Docker locally.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Fixed
 
+- A bounce could be recorded as a successful delivery. The log-tailer's
+  delivery-line pattern matched `status=` greedily, so it took the *last*
+  occurrence on the line — and Postfix appends the remote server's reply
+  verbatim, which the far end controls. A rejection whose reply text contained
+  `status=sent` was filed as `sent` in the send log. The pattern now takes the
+  first `status=` after the recipient, which is the real field
+  (`internal/logtail/logtail.go`); found while extending `TestParseDelivery`.
 - Log-tailer resumes where it stopped instead of jumping to end-of-file on
   every start (phase 3, `docs/code-review.md`): the read position and a
   fingerprint of the log's head are persisted (`logtail_state`, migration
@@ -24,6 +31,23 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ### Changed
 
+- The project has a single public home: `github.com/mixeme/selfpost`. Codeberg
+  is being retired, so the Go module path moved with it — `go.mod`,
+  `test/e2e/go.mod`, every import, the `Makefile` `MODULE` variable and the
+  `-ldflags` version stamp in `build/Dockerfile` and `docs/development.md`. An
+  import path pointing at a host that is going away would break `go get` and
+  `go install` outright, which is why this is not only a documentation change.
+  README no longer lists a primary/mirror pair.
+- Code comments no longer cite the archived specification. References like
+  "spec 7.6.1" or "spec 5.1" pointed into `docs/archive/specification-v1.0.md`,
+  which is explicitly not a source of truth; each is now a reference to the
+  live document that owns the subject — `docs/architecture.md` (with section),
+  `docs/product.md`, `docs/security.md`, or the README. Comments only; no
+  behaviour is affected.
+- `docs/architecture.md` gained a *Code layers* section: a diagram of
+  handlers → services → store plus the adapters, and the reason the services
+  layer exists (multi-store writes and their rollback) — closing item A2 of
+  `docs/code-review.md`.
 - Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale
   "Phase N" / historical-staging references from code and shell-script
   comments (`cmd/panel`, `internal/*`, `build/*`) now that v1.0 is done;
@@ -32,6 +56,15 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `docs/security.md` (why Origin-check, not tokens); resolved `docs/logo` in
   `docs/roadmap.md` (directory doesn't exist, criterion already met); added a
   `gofmt -l` check to CI (`.github/workflows/test.yml`).
+- Phase 2 GUI polish (`docs/code-review.md`): the monitoring pages stop
+  polling while their tab is hidden — the skip is done in an
+  `htmx:beforeRequest` listener (`internal/web/static/panel.js`) rather than
+  htmx's own trigger filter, which is evaluated with `new Function` and would
+  be blocked by the panel's CSP. Dark mode is now a single reassignment of CSS
+  custom properties under `prefers-color-scheme: dark` instead of a cascade of
+  `!important` overrides, and the duplicate `main { max-width }` rule is
+  consolidated into one base rule with documented per-page overrides
+  (`internal/web/static/panel.css`).
 
 ### Security
 
@@ -60,6 +93,10 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   `-decrypt` (with `-i`/`-o`) turns a `.spbk` into the plain `.tar.gz` a
   restore unpacks. The password comes from `SELFPOST_BACKUP_PASSWORD` or
   `-password-file`, never from argv.
+- `TestParseDelivery` covers the exotic mail.log shapes the review asked for
+  (`docs/code-review.md` § 3): a `status=` quoted inside the remote reply, the
+  null recipient of a double bounce, `orig_to=` alongside `to=`, an
+  unrecognised status word, a capitalised one, and a cleanup line.
 - docs: README *Encrypting a backup or export*; `docs/security.md` §
   *Резервная копия и экспорт домена* + accepted risk (encryption is opt-in);
   `docs/architecture.md` persistence § envelope summary.