backup: the panel's archive is the command's, private key included

Owner, 2026-10-11: the private key is needed, and a backup from the
panel and one from the console have to be the same.

The commit that made the panel's backup work skipped a file under
certs/ the panel could not open - on the test server the private key,
which the certificate hook leaves to root and Postfix's group. That gave
an archive with a certificate and no key, and two kinds of archive.

- Params.Unprivileged is gone. Nothing is left out on account of who
  makes the archive; the queue is out for everyone (previous commit).
- When the panel cannot read a file under certs/, backup.Check says so
  before the download and the panel refuses with what to do on the host:
  chgrp 998 certs/privkey.pem && chmod 640. backup.UnreadableCert tells
  that case from any other failure.
- 998 is the container's selfpost group, which holds the panel and
  Postfix. Its id was whatever groupadd gave; the Dockerfile now fixes
  it at the value it has always had, because an operator addresses it
  by number from the host.
- Guide: method 1 is the same archive as method 2, with the permission
  the key needs and a note for whatever renews the certificate. Help and
  the box follow the design commit before this one.
- e2e: the restore scenario first makes the key unreadable and expects
  the refusal naming the file and the way out, then takes the backup and
  expects the key in it; nothing is put back by hand before the restart.

  go vet ./internal/backup/ ./internal/web/handlers/: ok
  go test ./internal/backup/ ./cmd/... ./internal/web/...: ok
  make e2e on the test server: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -33,11 +33,13 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   and the panel is not that user ("open /data/postfix/queue/active:
   permission denied" in the log). `selfpost-backup` run with `docker exec`
   was not affected - it runs as root. The queue is no longer part of a backup
-  (see Changed), and the panel's archive leaves out a file in `certs/` it may
-  not open (usually the private key, named in the log); the page, Help and
-  the guide say so, and the guide says to put the key back before starting a
-  restored instance. Everything is read through before the download starts,
-  so a failure is a message on the page and not a file cut short.
+  (see Changed), so the two archives are the same again. Everything is read
+  through before the download starts, so a failure is a message on the page
+  and not a file cut short. One thing the panel may still be unable to read
+  is the private key in `certs/`: it then refuses and says what to do -
+  `chgrp 998 certs/privkey.pem && chmod 640 certs/privkey.pem` on the host,
+  998 being the container's `selfpost` group, whose id is now fixed in the
+  image.
 
 ### Security