findings of the security review of stage 0

The review of 2c27275..2c8e981 (read-only, a separate agent) found no high
or medium; three small ones, fixed here:

- reauth took a limiter attempt before the compare, right password
  included: with A2 asking on every user save, ten saves in fifteen
  minutes locked the administrator out of Account's password change, the
  backup and the export. A right password now gives its attempt back
  (rateLimiter.Refund, Module.PasswordCheckPassed; a bucket already at its
  limit stays blocked). TestRightAccountPasswordsDoNotUseUpTheLimit.
- LoggedPath hid the tokens of /login/reset/ and /confirm/ but not of the
  first administrator's /setup/<token>; now it does (test case added).
- The entrypoint's own `[ -e ] || : >` lines (sender_login_maps, the four
  inbound maps, mail.log) get the `[ -L ]` guard postfix-config.sh got for
  I2. Safe before too - drop_links runs first on those paths and the panel
  is not running yet - this is the belt and braces.

The review also confirmed, with a probe of the regex against Postfix's
formats, that a port-25 client can place only its own envelope in an
Inbound log row, and that every path to a password, e-mail or role asks
for the signed-in password.

go test ./internal/web/handlers ./internal/web/auth; sh -n entrypoint.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

build/entrypoint.sh

@@ -150,11 +150,11 @@ rm -f /data/sasl/sasldb2.new
 # Postfix state under /data (architecture.md § Persistence). The panel writes
 # sender_login_maps; Postfix owns the on-disk queue tree under queue/.
 mkdir -p /data/postfix/queue
-[ -e /data/postfix/sender_login_maps ] || : > /data/postfix/sender_login_maps
+[ -e /data/postfix/sender_login_maps ] || [ -L /data/postfix/sender_login_maps ] || : > /data/postfix/sender_login_maps
 # Inbound relay maps (written by the panel when INBOUND_RELAY_ENABLE=true).
 # Empty files keep postfix check happy if the flag is on before any domain exists.
 for f in relay_domains transport relay_recipients tls_policy; do
-	[ -e "/data/postfix/$f" ] || : > "/data/postfix/$f"
+	[ -e "/data/postfix/$f" ] || [ -L "/data/postfix/$f" ] || : > "/data/postfix/$f"
 done
 # Every map here is the panel's to write and Postfix's to read - the sender
 # map, the inbound and the DMARC maps alike - so each file beside queue/ is
@@ -196,7 +196,7 @@ chmod 0755 /data/antispam
 # because parent directory has insecure permissions" when the directory's
 # group is not root and has write permission.
 mkdir -p /data/log
-[ -e /data/log/mail.log ] || : > /data/log/mail.log
+[ -e /data/log/mail.log ] || [ -L /data/log/mail.log ] || : > /data/log/mail.log
 chown -R postfix:selfpost /data/log
 chmod 2750 /data/log
 find /data/log -type f -exec chmod 0640 {} +