docs: stage 2 of the audit - roles, the guard, logs by id, import, logins

security.md
- § Roles: the last-global guard is inside the transaction that deletes or
  demotes (write, then count); setup is one statement; a user is saved in
  one transaction. A log row, outbound or inbound, belongs to a domain by
  id; a domain added again starts with an empty log. The Inbound › Log row of
  the table says by id.
- § Mail path, sender check: the agreement of the check and OpenDKIM is
  tested (the shared list of passed From: lines); the refusal does not say
  which other sender a line names.
- Accepted risks: "a row of the inbound log belongs to a domain by name"
  struck (L12).

guide.md
- Domain export and import: the file is checked like the forms before
  anything is created; a login keeps its case and a case clash is refused.
- The application form: a new login is stored in lower case.

schema-migrations.md was updated with 0008 in its commits. Audit plan line
ticked; stage 2's lines are all done. Roadmap 22/62.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -688,7 +688,7 @@ has already run is never edited — the next file is added; the published
    are still in the global log. — **Opus**
    *Done 2026-10-14.* DMARC reports stay by name on purpose: a report is
    about the name in DNS, and whoever holds the name now is its reader.
-- [ ] Docs: security.md § Roles (the guard) and the struck accepted risk, guide
+- [x] Docs: security.md § Roles (the guard) and the struck accepted risk, guide
    § Domain export, schema-migrations.md. — **Sonnet**
 - [x] **Which key OpenDKIM signs with, seen and not reasoned** (owner,
    2026-10-13, from the Not verified list of from-header-binding). The check