test: cover the auth, sign-in and RBAC surfaces P0 shipped through (P4)

- internal/web/auth/ratelimit_test.go: the login/setup limiter's ceiling,
  per-address scope, window reset and the sweep that keeps finished
  buckets out of memory.
- internal/web/auth/handlers_test.go: sign-in (session issued, refusals
  that do not reveal which usernames exist, a lockout a correct password
  cannot bypass, the setup hint before the first administrator) and the
  one-time setup link (creates the first global administrator and then
  closes, rejects a wrong or expired token, refuses credentials the panel
  would not accept later, rate-limited).
- internal/web/handlers/authz_test.go: every global-only route answers a
  domain administrator — and a request with no principal — with 404, with
  a positive control so the table cannot pass on a handler that always
  404s. This is the check that would have caught the send-log leak.
- test/e2e: CoreDNS pinned to 1.14.6 instead of latest; the level-1
  failure message quoted RATE_LIMIT_MESSAGES_PER_IP=5 while the stand
  sets 50.

docs/plans/code-review.md P4 checked off except the optional backup-boot
test; CHANGELOG updated. No production code changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -562,12 +562,19 @@ cannot be a single unmarked click.
 **Model: Opus** for auth/RBAC/limiter tests; **Haiku** for the L1 fatal-string
 typo; **Sonnet** if e2e docs need a paragraph.
 
-- [ ] `auth/ratelimit.go` unit tests (window, lockout, sweep).
-- [ ] Login/setup handler tests (happy path + lockout + setup expiry).
-- [ ] Domain-admin 404 on `/users`, `/backup`, `/mail-queue`, `/system-log`,
-      `/status` (if not already implied by P0 tests).
-- [ ] Fix e2e L1 fatal string (`50`, not `5`).
-- [ ] Pin `coredns` image digest or a major version.
+- [x] `auth/ratelimit.go` unit tests (window, lockout, sweep). Also the
+      per-key scope: one locked-out address must not lock out the others.
+- [x] Login/setup handler tests (happy path + lockout + setup expiry). The
+      lockout test also states that a correct password does not bypass it, and
+      that the two refusals are byte-identical (no username enumeration).
+- [x] Domain-admin 404 on `/users`, `/backup`, `/mail-queue`, `/system-log`,
+      `/status` — as a table of every global-only route (`internal/web/handlers/authz_test.go`),
+      including the write routes, plus the same 404 for a request with no
+      principal and a positive control so the table cannot pass on a handler
+      that always 404s.
+- [x] Fix e2e L1 fatal string (`50`, not `5`).
+- [x] Pin `coredns` image: tag `1.14.6`, not a digest — the tag is a multi-arch
+      manifest and the stand has to come up on arm64 developer machines.
 - [ ] Optional later: backup extract + `CheckRestore` + panel boot (heavy;
       e2e or integration). Not a P4 blocker.