audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/domain/service.go

@@ -267,8 +267,35 @@ func (s *Service) ClearRateLimit(domainID int64) error {
 // OpenDKIM. It backs the manual reload button (architecture.md § Panel HTTP
 // surface) and doubles as a recovery path if the tables ever drift from the
 // database.
+//
+// It also removes the key directories of names no domain has and that are
+// not the server's own: what a deletion left when the tables could not be
+// rebuilt (Delete keeps the key then). The "Reload configuration" the page
+// points to after such a deletion finishes it here (review of audit stage 4).
 func (s *Service) Resync() error {
-	return s.resync()
+	if err := s.resync(); err != nil {
+		return err
+	}
+	domains, err := s.store.ListDomains()
+	if err != nil {
+		return err
+	}
+	keep := map[string]bool{s.serverName: true}
+	for _, d := range domains {
+		keep[d.Name] = true
+	}
+	names, err := s.odk.KeyDomains()
+	if err != nil {
+		return err
+	}
+	for _, name := range names {
+		if !keep[name] {
+			if err := s.odk.RemoveKey(name); err != nil {
+				return fmt.Errorf("remove the key of %s, a domain that is gone: %w", name, err)
+			}
+		}
+	}
+	return nil
 }
 
 // resync rebuilds KeyTable/SigningTable from the current domain set and reloads.