audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -610,7 +610,12 @@ deferred item from the roadmap.
   panel itself makes no request to the upstream. Trigger to revisit: `domain`
   users who are not trusted operators — the same condition as for CSRF tokens
   — at which point an allow-list of upstream networks, or restricting the
-  field to the global role, is the fix.
+  field to the global role, is the fix. Since `2.5.4` an upstream has one TLS
+  mode for every inbound domain forwarded to it (Postfix keys the policy by
+  the next hop): a `domain` user saving one that another tenant's domain
+  uses with another mode is refused and told that mode - not the domain -
+  so the form tells whether some domain forwards to a given host and port.
+  Accepted with the rest of this item.
 - **Account's profile (username, e-mail) is saved without the password.**
   Saving the profile does not ask for the current password, as changing the
   password does. Since 2.3.0 the e-mail is where notifications go, so a stolen
@@ -619,7 +624,9 @@ deferred item from the roadmap.
   certificate expires, sender addresses of old queued mail - and the user
   stops hearing it. Nothing in a notification gives access. A `domain` user
   can likewise point signed mail of this server at a third party's address,
-  a dozen messages a day per assigned domain at most. It
+  a dozen messages a day per assigned domain at most. The profile form also
+  says when a username is taken, so a signed-in user can tell which
+  usernames exist; signing in does not (`2.5.4`). It
   becomes a requirement to ask for the current password when changing
   `users.email` as soon as [password-reset](roadmap.md#password-reset) mails a
   link to it — from then on whoever can change the address could take the