Phase 4: applications + SASL (sasldb2) + sender_login_maps

Adds application accounts bound to domains: a SASL login/password in
sasldb2, a per-application address mode (wildcard @domain or an explicit
list), and matching smtpd_sender_login_maps bindings — with create,
list, edit-mode, delete and password regeneration (spec 4.1, 5.1,
7.2.5-9). Generated passwords are shown exactly once and never stored in
plaintext (7.6.1).

- internal/store/applications.go: transactional CRUD; globally unique
  login; ListBindings (address->login) as the map source; logins-by-
  domain for pre-cascade SASL cleanup.
- internal/app: saslpasswd2 wrapper (password via stdin, login as a
  whitelisted argv element, no shell — 7.6.3); strong base64url password;
  address validation that enforces domain ownership before any config
  write (7.6.2); service orchestrating store + sasldb2 + map with full
  rollback on partial failure.
- internal/postfix: sender_login_maps regenerated as a pure function of
  the registry (many-to-one logins merged per address), atomic write,
  injection backstop (7.6.4).
- Postfix reload, corrected: `postfix start-fg` forks a separate master,
  so signalling the supervised process never reaches it. Reload now runs
  the canonical `postfix reload` via a one-shot supervisord program the
  unprivileged panel triggers over the group control socket. Verified in
  mail.log.
- domain.Service.Delete purges the domain's SASL accounts, then cascades,
  then rebuilds the sender map and reloads; manual reload now covers both
  OpenDKIM and Postfix.
- web: application management in the domain page, one-time credential
  shown inline; postfix joins the selfpost group and entrypoint normalises
  /data/sasl and /data/postfix (setgid, group-readable) with self-heal.

Verified on the dev server: gofmt/vet/test green, image builds, and a
container e2e covers the full application lifecycle, domain-delete
cascade, restart persistence, and a real postfix reload.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/handlers_domains.go

@@ -78,26 +78,6 @@ func (s *Server) handleAddDomain(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, fmt.Sprintf("/domains/%d", d.ID), http.StatusSeeOther)
 }
 
-// handleDomainDetail shows a single domain and its DKIM DNS record (spec 7.2.10).
-func (s *Server) handleDomainDetail(w http.ResponseWriter, r *http.Request) {
-	d, ok := s.lookupDomain(w, r)
-	if !ok {
-		return
-	}
-	record, err := s.domains.DKIMRecord(d)
-	if err != nil {
-		logf("panel: domain %d: dkim record: %v", d.ID, err)
-		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
-	}
-	s.render(w, http.StatusOK, "domain_detail", map[string]any{
-		"Title":  "SelfPost — " + d.Name,
-		"User":   currentUser(r),
-		"Domain": d,
-		"Record": record,
-	})
-}
-
 // handleDeleteConfirm shows the cascade warning before a domain is removed: the
 // panel must explicitly state that all bound applications go with it (spec 7.2.4).
 func (s *Server) handleDeleteConfirm(w http.ResponseWriter, r *http.Request) {
@@ -131,11 +111,17 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/?deleted=1", http.StatusSeeOther)
 }
 
-// handleReload re-applies the OpenDKIM configuration on demand (spec 7.2.12).
-// The Postfix side of the reload button lands in Phase 5.
+// handleReload re-applies both the OpenDKIM configuration and the Postfix
+// sender map on demand (spec 7.2.12). Each Resync regenerates its files from the
+// database and reloads its daemon, so the button doubles as a drift-recovery.
 func (s *Server) handleReload(w http.ResponseWriter, r *http.Request) {
 	if err := s.domains.Resync(); err != nil {
-		logf("panel: manual reload: %v", err)
+		logf("panel: manual reload (opendkim): %v", err)
+		http.Error(w, "reload failed", http.StatusInternalServerError)
+		return
+	}
+	if err := s.apps.Resync(); err != nil {
+		logf("panel: manual reload (postfix): %v", err)
 		http.Error(w, "reload failed", http.StatusInternalServerError)
 		return
 	}