docs: panel header, type scale, account e-mail and the fixes of a full review

Header. The navbar carries the wordmark instead of the stamp - at nav
size the stamp dissolves into the brick bar - and under the bar runs the
stamp's paper margin with the perforation along its outer edge: round
holes, flat teeth, ink hairline, 8px under a 60px bar as on the mark.
docs/assets/selfpost-wordmark.svg and -ink are the stamp's own outlines;
the header comparison sheet is removed.

Type and tables. About 40 % of the text measured under 13px. Body is
16px with two tokens under it, 14px for supporting text and 13px for
upper-case mono labels and tags; Bulma's small sizes are overridden or
dropped (sp-small replaces is-size-7, is-small only on a progress bar).
Every table sits in a table-container, addresses break after the @, and
all screens fit without scrolling at 1280px and up.

Contrast. A sweep of every text node against its real ground found the
solid red button at 3:1, the muted grey at 4.1:1, the amber postmark and
Bulma's menu labels just under 4.5. All 33 screens now measure 4.5:1 or
better. The sweep is kept as panel/audit.js and its clean output joins
the evidence a restyle step must show.

Account and roles. A user's e-mail is its own field (users.email in the
2.0 baseline), edited under Account and seen by the global user on the
user form and list. The DMARC default report address is a user's
setting, not the server's: it moves to Account with its authorization
record, and a domain follows the default of a named user. Roles are
labelled by reach - global, domain - and each assignment list gains All,
a per-user flag that covers domains added later. Account gains
Notifications for the new roadmap candidate panel-notifications;
password-reset is added as a candidate too.

Also: the inbound spam filter is visible where a domain user looks (a
box on each inbound domain, a tag on the list, its socket on Health);
the health row is compact again and splits 6/3/2; a read-only value is
as tall as its Copy button; Preflight and Account lose boxes that only
filled space, and the plan's layout rule and contract now forbid them.

check.py gains the type floor, the table-container rule and the is-small
rule, and no longer counts min-width: 0 as setting a width.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

docs/roadmap.md

@@ -36,6 +36,8 @@ in `git log` and [CHANGELOG.md](../CHANGELOG.md).
 | template-data-typing | Typed structs for template data instead of `map[string]any` | candidate | — | — |
 | structured-logging | `log/slog` with levels and fields | candidate | — | — |
 | review-2026-08-followups | Remaining findings of the 2026-08-19 code review | candidate | — | — |
+| panel-notifications | E-mail notifications about important events | candidate | — | — |
+| password-reset | Password reset by e-mail | candidate | — | — |
 | panel-redesign | Panel redesign (accepted mockups, design contract) | candidate | 3/21 | [plans/panel-redesign.md](plans/panel-redesign.md) |
 | schema-squash | Squash SQLite migrations into a 2.x baseline | **2.x** | — | — |
 
@@ -295,6 +297,56 @@ and tagging it would only delete cross-platform test coverage.
 
 ---
 
+## panel-notifications
+
+**Goal:** the panel tells its administrators when something needs them instead
+of waiting to be opened: a DNS record stops matching, a domain or application
+hits its rate limit and mail is refused, an inbound upstream is unreachable,
+DMARC failures appear, mail is held in quarantine; for the global
+administrator also the TLS certificate nearing expiry, a process or milter
+socket down, a queue older than a day.
+
+**Boundary:** e-mail only, sent through the relay itself from
+`postmaster@<hostname>`. Each user picks events under **Account**; a domain
+administrator hears only about assigned domains. One message when a problem
+starts and one when it clears — no streams, no digests in v1. One instance
+switch under **Server › Settings**. No webhooks, no chat integrations.
+
+**Done when:** an event from the list reaches the account e-mail of every user
+who chose it and may see its subject, once on start and once on clear; a user
+without an e-mail gets nothing; the switch turns it all off.
+
+**Dependencies / risks:** the account e-mail (2.0 baseline, see
+[plans/panel-redesign.md](plans/panel-redesign.md) § Account e-mail); a relay
+that cannot send cannot report that it cannot send — server events need the
+direct-to-MX path or stay panel-only; event state must survive restarts so a
+reboot does not re-announce everything. Screens are drawn: `account`,
+`settings`.
+
+**Version:** `2.x` MINOR; `candidate`.
+
+---
+
+## password-reset
+
+**Goal:** a user who forgot their password gets a one-time link at their
+account e-mail instead of asking the global administrator to set a new one.
+
+**Boundary:** a link on the sign-in page, a short-lived single-use token, the
+same answer whether or not the username exists. The only global administrator
+without a working e-mail still recovers from the container (today's path).
+
+**Done when:** the flow works end to end, tokens expire and cannot be reused,
+requests are rate-limited, and it passes a security review.
+
+**Dependencies / risks:** the account e-mail; an account-takeover surface where
+there was none — security review is part of the item, not an afterthought.
+Not drawn yet.
+
+**Version:** `2.x` MINOR; `candidate`.
+
+---
+
 ## panel-redesign
 
 **Goal:** a panel an operator opens a few times a year and still finds their