test: cover the auth, sign-in and RBAC surfaces P0 shipped through (P4)

- internal/web/auth/ratelimit_test.go: the login/setup limiter's ceiling,
  per-address scope, window reset and the sweep that keeps finished
  buckets out of memory.
- internal/web/auth/handlers_test.go: sign-in (session issued, refusals
  that do not reveal which usernames exist, a lockout a correct password
  cannot bypass, the setup hint before the first administrator) and the
  one-time setup link (creates the first global administrator and then
  closes, rejects a wrong or expired token, refuses credentials the panel
  would not accept later, rate-limited).
- internal/web/handlers/authz_test.go: every global-only route answers a
  domain administrator — and a request with no principal — with 404, with
  a positive control so the table cannot pass on a handler that always
  404s. This is the check that would have caught the send-log leak.
- test/e2e: CoreDNS pinned to 1.14.6 instead of latest; the level-1
  failure message quoted RATE_LIMIT_MESSAGES_PER_IP=5 while the stand
  sets 50.

docs/plans/code-review.md P4 checked off except the optional backup-boot
test; CHANGELOG updated. No production code changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

test/e2e/compose.override.yml

@@ -60,8 +60,13 @@ services:
   # records the test harness publishes, so Postfix's outbound MX lookup for
   # the sink and the panel's own dnscheck resolve inside the isolated network
   # instead of hitting the real internet.
+  #
+  # Pinned to a release tag rather than `latest`, so a CoreDNS upload cannot
+  # change what the release gate runs against between two runs of the same
+  # commit. Not a digest: the tag is a multi-arch manifest and the stand has to
+  # come up on arm64 developer machines as well as amd64 CI.
   coredns:
-    image: coredns/coredns:latest
+    image: coredns/coredns:1.14.6
     command: ["-conf", "/dns/Corefile"]
     volumes:
       - ./dns-stage:/dns