audit 4: findings of the two reviews

- Two inbound domains on one upstream could never change its TLS mode,
  each save refused for the other (medium): SetTransportAs changes the
  mode for every domain on the upstream when the one saving may change
  them all; a domain user who may not is refused with the mode, not the
  other tenant's domain name (security F1: the first version named it).
- A deletion's leftover DKIM key is removed by Resync (Reload
  configuration, a restore's first start) for names no domain has.
- The backup's write deadline moves before Check.
- hasUnsavedEdit skips password and file fields and compares a multiple
  select's options; htmx.config.timeout 30 s, so a refresh never answered
  ends and is tried again; a failed refresh's promise is handled.
- An empty filtered Outbound log says no message matches the filters.
- The dummy bcrypt hash is made at start; a DMARC part over 8 MiB is
  refused for its size like the other two limits.
- Health's Configuration box says what Reload writes (design first,
  32dfe4a).
- Docs: CHANGELOG, guide § Inbound, security.md (the shared upstream's
  mode, the profile form's "username taken"), architecture.md (owed to an
  address), the plan's notes corrected.
Tests: the shared upstream (service, handler), the leftover key, all eight
Health boxes ordered, the subject from before migration 0011, the new JS
cases.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 636 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/static/panel.js

@@ -119,17 +119,26 @@
   // what the markup said (HTML Living Standard, the input, select and
   // textarea elements). A select none of whose options says selected was
   // drawn with its first option, or none when it is a list (size or multiple).
+  // Password and file fields are not edits of the page: a password manager
+  // fills the first, nothing draws the second (review of stage 4).
   function hasUnsavedEdit() {
     var fields = document.querySelectorAll("input, select, textarea");
     for (var i = 0; i < fields.length; i++) {
       var f = fields[i];
-      if (f.disabled || f.type === "hidden" || f.type === "submit" || f.type === "button" || f.type === "reset") {
+      if (f.disabled || f.type === "hidden" || f.type === "submit" || f.type === "button" ||
+          f.type === "reset" || f.type === "password" || f.type === "file") {
         continue;
       }
       if (f.type === "checkbox" || f.type === "radio") {
         if (f.checked !== f.defaultChecked) {
           return true;
         }
+      } else if (f.tagName === "SELECT" && f.multiple) {
+        for (var m = 0; m < f.options.length; m++) {
+          if (f.options[m].selected !== f.options[m].defaultSelected) {
+            return true;
+          }
+        }
       } else if (f.tagName === "SELECT") {
         var drawn = -1;
         for (var j = 0; j < f.options.length; j++) {
@@ -298,13 +307,27 @@
   // issueAjaxRequest(verb, path, resolveTarget(context.source), ...), and
   // with no source issueAjaxRequest() falls back to the document's body).
   function triggerPoll(el) {
-    htmx.ajax("GET", el.getAttribute("hx-get"), {
+    var done = htmx.ajax("GET", el.getAttribute("hx-get"), {
       source: el,
       target: "#" + el.id,
       swap: el.getAttribute("hx-swap") || "outerHTML"
     });
+    // A failed refresh is handled by htmx:afterRequest below; the promise
+    // htmx.ajax returns is rejected too, and is not to be left unhandled.
+    if (done && done.catch) {
+      done.catch(function () {});
+    }
   }
 
+  // A request that never ends - a panel stopped mid-answer, a proxy holding
+  // it - would end no refresh, and no next one would be scheduled: htmx's
+  // default timeout is none (htmx 2.0.4, src/htmx.js: config.timeout 0, and
+  // issueAjaxRequest() takes requestConfig.timeout from it when neither the
+  // call nor hx-request says one; xhr.timeout = requestConfig.timeout). Thirty seconds is twice the
+  // slowest page the panel draws, one that asks DNS; then htmx:timeout,
+  // and htmx:afterRequest with it.
+  htmx.config.timeout = 30000;
+
   function schedulePoll(el) {
     if (!el || !el.id || !el.hasAttribute("data-poll")) {
       return;