backup: the panel's archive is the command's, private key included

Owner, 2026-10-11: the private key is needed, and a backup from the
panel and one from the console have to be the same.

The commit that made the panel's backup work skipped a file under
certs/ the panel could not open - on the test server the private key,
which the certificate hook leaves to root and Postfix's group. That gave
an archive with a certificate and no key, and two kinds of archive.

- Params.Unprivileged is gone. Nothing is left out on account of who
  makes the archive; the queue is out for everyone (previous commit).
- When the panel cannot read a file under certs/, backup.Check says so
  before the download and the panel refuses with what to do on the host:
  chgrp 998 certs/privkey.pem && chmod 640. backup.UnreadableCert tells
  that case from any other failure.
- 998 is the container's selfpost group, which holds the panel and
  Postfix. Its id was whatever groupadd gave; the Dockerfile now fixes
  it at the value it has always had, because an operator addresses it
  by number from the host.
- Guide: method 1 is the same archive as method 2, with the permission
  the key needs and a note for whatever renews the certificate. Help and
  the box follow the design commit before this one.
- e2e: the restore scenario first makes the key unreadable and expects
  the refusal naming the file and the way out, then takes the backup and
  expects the key in it; nothing is put back by hand before the restart.

  go vet ./internal/backup/ ./internal/web/handlers/: ok
  go test ./internal/backup/ ./cmd/... ./internal/web/...: ok
  make e2e on the test server: ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/backup/backup_test.go

@@ -5,7 +5,9 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/json"
+	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"strings"
@@ -236,11 +238,11 @@ func TestCheckRestoreWrongFormatRejected(t *testing.T) {
 	}
 }
 
-// The panel's archive: like any other it has no Postfix queue, the rest is
-// there, and Check agrees that it can be made.
-func TestCreateUnprivilegedLeavesTheQueueOut(t *testing.T) {
+// No archive holds the Postfix queue; the rest is there, the private key
+// included, and Check agrees that it can be made.
+func TestCreateLeavesTheQueueOut(t *testing.T) {
 	dataDir, dbPath, deployRoot := seedDataDir(t)
-	p := Params{DataDir: dataDir, DBPath: dbPath, Version: "1.2.3", DeployRoot: deployRoot, Unprivileged: true}
+	p := Params{DataDir: dataDir, DBPath: dbPath, Version: "1.2.3", DeployRoot: deployRoot}
 
 	if err := Check(p); err != nil {
 		t.Fatalf("Check: %v", err)
@@ -262,6 +264,7 @@ func TestCreateUnprivilegedLeavesTheQueueOut(t *testing.T) {
 		DataArchivePrefix + "postfix/sender_login_maps",
 		ComposeFileName, EnvFileName,
 		CertsDirName + "/fullchain.pem",
+		CertsDirName + "/privkey.pem",
 	} {
 		if _, ok := files[name]; !ok {
 			t.Errorf("archive missing %s", name)
@@ -269,6 +272,28 @@ func TestCreateUnprivilegedLeavesTheQueueOut(t *testing.T) {
 	}
 }
 
+// A file under certs/ that may not be read is told apart from any other
+// failure, so the panel can say what to do about it.
+func TestUnreadableCert(t *testing.T) {
+	root := filepath.Join("srv", "deploy")
+	denied := func(path string) error {
+		return fmt.Errorf("backup: open %s: %w", path, &fs.PathError{Op: "open", Path: path, Err: fs.ErrPermission})
+	}
+	if name, ok := UnreadableCert(denied(filepath.Join(root, "certs", "privkey.pem")), root); !ok || name != "certs/privkey.pem" {
+		t.Errorf("certs/privkey.pem: got %q, %v", name, ok)
+	}
+	if name, ok := UnreadableCert(denied(filepath.Join(root, ".env")), root); ok {
+		t.Errorf(".env was taken for a certificate file: %q", name)
+	}
+	if name, ok := UnreadableCert(denied(filepath.Join("data", "postfix", "x")), root); ok {
+		t.Errorf("a data file was taken for a certificate file: %q", name)
+	}
+	missing := &fs.PathError{Op: "open", Path: filepath.Join(root, "certs", "privkey.pem"), Err: fs.ErrNotExist}
+	if _, ok := UnreadableCert(missing, root); ok {
+		t.Error("a missing file was taken for one that may not be read")
+	}
+}
+
 // Check finds what Create would stumble over, before anything is written.
 func TestCheckReportsWhatCannotBeRead(t *testing.T) {
 	dataDir, dbPath, deployRoot := seedDataDir(t)