import: the export file held to the forms' rules before anything is created (audit M10)

domain.Import trusted the file for everything but the domain name, the
selector and the password: DMARCRua was not validate.Email'ed, client IPs
not parsed, a rate limit's mode, window and count not checked - a window of
0 counted nothing, a garbage IP made the application refuse every client.

handlers.checkDomainImport runs in HandleImportDomain after the domain name
check and before Import, and refuses the file with "Invalid <what> in export
file: <the form's own text>": the report address (validate.Email), each
rate limit (parseRateLimitMode; auto - checkAutoMultiplier, 0 meaning the
default as an empty field does; manual - checkManualLimit, which the form
now uses too: count > 0, <= the level-1 backstop, window > 0; both 0 is an
export without a limit of its own), each application's client addresses
and the legacy ones on its rate limit (parseIPList, written back as the
form stores them; allow-list on with none is refused). Login, sending
addresses and password stay checked in app.ImportApplication.

Tests: a good export passes and its addresses come out normalised; nine
broken fields each refused with their message; a refused file posted to the
handler creates no domain.

CHANGELOG [Unreleased], audit plan line ticked, roadmap 18/62.
Evidence: go vet clean; the import, rate-limit and application tests of
./internal/web/handlers ok; the server run follows before the push.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -669,7 +669,7 @@ has already run is never edited — the next file is added; the published
 - [x] **`submitUserUpdate` in one transaction** (store method that takes the
    whole change). The users pages get direct handler tests while they are
    rewired - a row of review-2026-08-followups, placed here 2026-10-14. — **Opus**
-- [ ] **Import validates like the form**: route `DMARCRua`, IPs, limit mode,
+- [x] **Import validates like the form**: route `DMARCRua`, IPs, limit mode,
    window and count through the same parsers; refuse the file with the
    validator's text. Tests per field. — **Opus**
 - [ ] **Send-log rows belong to a domain by id** (L12; owner, 2026-10-12).