audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/inbound/service_test.go

@@ -2,7 +2,6 @@ package inbound
 
 import (
 	"errors"
-	"strings"
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/postfix"
@@ -14,9 +13,11 @@ type nullMaps struct{}
 func (nullMaps) RebuildInboundMaps([]postfix.InboundRoute) error { return nil }
 
 // An upstream has one TLS mode, since Postfix keys the policy by the next
-// hop: a second domain saved to the same [host]:port with another mode is
-// refused with the first domain's name and mode; the same mode is fine
-// (audit 2026-10-12, L5).
+// hop (audit 2026-10-12, L5): the other domains forwarded to it take the mode
+// saved for one of them, when the one saving may change them; one they may
+// not is refused, and nothing is saved. Two domains on one upstream can
+// change its mode (review of stage 4: they could not, each refused for the
+// other).
 func TestOneTLSModePerUpstream(t *testing.T) {
 	st, err := store.Open(t.TempDir() + "/test.db")
 	if err != nil {
@@ -24,30 +25,44 @@ func TestOneTLSModePerUpstream(t *testing.T) {
 	}
 	defer st.Close()
 	s := NewService(st, nullMaps{})
-	a, err := s.Add("a.example")
-	if err != nil {
+	a, _ := s.Add("a.example")
+	b, _ := s.Add("b.example")
+	c, _ := s.Add("c.example")
+	mode := func(id int64) string {
+		d, err := st.GetInboundDomain(id)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return d.TLSMode
+	}
+	all := func(store.InboundDomain) bool { return true }
+
+	if _, err := s.SetTransportAs(a.ID, "10.0.0.8", "25", "encrypt", all); err != nil {
 		t.Fatal(err)
 	}
-	b, err := s.Add("b.example")
-	if err != nil {
-		t.Fatal(err)
+	if n, err := s.SetTransportAs(b.ID, "[10.0.0.8]", "25", "encrypt", all); err != nil || n != 0 {
+		t.Fatalf("the same mode: %d, %v", n, err)
 	}
-	if err := s.SetTransport(a.ID, "10.0.0.8", "25", "encrypt"); err != nil {
-		t.Fatal(err)
+	// Either domain changes the mode, for both.
+	if n, err := s.SetTransportAs(a.ID, "10.0.0.8", "25", "may", all); err != nil || n != 1 {
+		t.Fatalf("a changes the shared mode: %d, %v", n, err)
 	}
-	err = s.SetTransport(b.ID, "[10.0.0.8]", "25", "may")
-	var verr *ValidationError
-	if !errors.As(err, &verr) || !strings.Contains(err.Error(), "[10.0.0.8]:25 is already the upstream of a.example, with TLS mode encrypt") {
-		t.Fatalf("a second mode for one upstream = %v", err)
+	if mode(a.ID) != "may" || mode(b.ID) != "may" {
+		t.Errorf("modes after a's change: %s, %s", mode(a.ID), mode(b.ID))
 	}
-	if err := s.SetTransport(b.ID, "10.0.0.8", "25", "encrypt"); err != nil {
-		t.Errorf("the same mode refused: %v", err)
+	// Another port is another next hop.
+	if n, err := s.SetTransportAs(c.ID, "10.0.0.8", "2525", "none", all); err != nil || n != 0 {
+		t.Errorf("another port: %d, %v", n, err)
 	}
-	if err := s.SetTransport(b.ID, "10.0.0.8", "2525", "may"); err != nil {
-		t.Errorf("another port refused: %v", err)
+
+	// One that may not change b is refused, with b's mode, and saves nothing.
+	notB := func(d store.InboundDomain) bool { return d.ID != b.ID }
+	_, err = s.SetTransportAs(c.ID, "10.0.0.8", "25", "encrypt", notB)
+	var shared *UpstreamShared
+	if !errors.As(err, &shared) || shared.Mode != "may" || shared.Domain != "b.example" || shared.Upstream != "[10.0.0.8]:25" {
+		t.Fatalf("a mode for another's upstream = %v", err)
 	}
-	// The domain itself may change its own mode.
-	if err := s.SetTransport(a.ID, "10.0.0.8", "25", "may"); err != nil {
-		t.Errorf("a domain changing its own mode refused: %v", err)
+	if d, _ := st.GetInboundDomain(c.ID); d.Port != 2525 || mode(a.ID) != "may" {
+		t.Errorf("the refused save changed something: c on %d, a %s", d.Port, mode(a.ID))
 	}
 }