docs: the panel as it is in 2.0

Stage 3, step 3. Written by Sonnet from the code and the plan, checked
by Opus.

  - guide.md: a section on the panel - menu, paths, the roles global and
    domain with outbound and inbound assigned separately -, Overview and
    Health, Queue and System log, Account and Server > Settings, the
    domain page / Domain settings / application form, Help as a page of
    topics. The DMARC report address is one of three choices set in
    Domain settings. The Spam filter box, the two INBOUND_ANTISPAM_*
    variables the panel reads, and the filter's socket on Health.
    Sessions; backup and export encrypted unless the box is unticked;
    1.x data is not restored into 2.0.
  - architecture.md: Panel HTTP surface rewritten from web.go (routes,
    the /server/ guard, per-object checks, <page>/fragment, one layout,
    typed page data, the kit and its guards, CSP and htmx); Persistence
    gains the database - one baseline, a 1.x file refused, the tables as
    they are.
  - security.md: roles and what each reaches, as built; sessions by user
    id and what ends them; state-changing requests; errors shown to
    users; the 2.0 review; two accepted risks from it - a delegated
    inbound upstream may be any host and port, and Account's profile is
    saved without the password.
  - CHANGELOG: Removed opens with "2.0 starts from an empty data
    directory"; entries that describe the user-default report address
    say they were replaced before release; the filter's socket.
  - roadmap.md: two review follow-up rows struck as retired by the
    redesign (.pair / .split, the two back links); password-reset notes
    that changing the account e-mail must then ask for the password.
    Progress 25/27.
  - development.md: the component kit and its guards; README and
    product.md: wording.

Left as they are
  - The third follow-up row the plan expected to strike - initShowWhen
    is not re-run after an htmx swap - still holds: no polled fragment
    carries such a control today, so nothing breaks, but the redesign did
    not retire it.
  - guide.md embeds no screenshots, so none needed retaking.
  - README and guide still name image 1.9.5 - the version cut.
  - plans/preflight.md and plans/inbound-antispam-panel.md use pre-2.0
    paths; roadmap's template-data-typing is largely done by the
    redesign.

  go test -count=1 ./cmd/panel (env-doc tables): ok

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/development.md

@@ -352,6 +352,30 @@ go test ./...
 — every new `loadConfig` key must appear in the env lists in [guide.md](guide.md)
 ([cmd/panel/envdoc_test.go](../cmd/panel/envdoc_test.go)).
 
+### Panel pages: the component kit and its guards
+
+Every panel page is built from the component kit in
+[internal/web/view](../internal/web/view): partials in
+`templates/components.html`, their typed input in `components.go`, one stylesheet
+`static/panel.css`, one layout `layout.html`. A page template calls partials with
+a struct from a `view.New…` constructor and writes no component markup of its
+own ([architecture.md § Panel HTTP surface](architecture.md#panel-http-surface)).
+The guard tests (`internal/web/guard_*_test.go`, `internal/web/view/guard_*_test.go`)
+run in `go test ./...` and read their rules from the accepted mockups under
+[docs/assets/panel-redesign/panel/](assets/panel-redesign/index.html): which
+classes and icons exist, what `panel.css` may contain, what component skeleton
+each page has, which routes exist. A failing guard means the page is wrong, not
+the guard.
+
+Changing the design is mockup first: edit the fragment under `panel/src/`, run
+`build.py` and `check.py --write`, commit as `design: …`, get it accepted, and
+only then touch `internal/web`. CI enforces the order with `design-first`
+([.github/scripts/design-first.sh](../.github/scripts/design-first.sh)): a commit
+that changes the mockups, a guard or the script touches nothing else under
+`internal/web/`, and a template that returns from git history is refused.
+[plans/panel-redesign.md](plans/panel-redesign.md) § The contract and
+§ Enforcement have the full rules.
+
 ### End-to-end (container suite)
 
 Separate Go module `test/e2e/`; **not** included in the main module's
@@ -391,7 +415,9 @@ Workflows in [.github/workflows/](../.github/workflows/). What each job runs —
 
 ### `test.yml` — every push and PR to `main`
 
-`gofmt -l` → `go vet ./...` → `go test ./...` (main module, no e2e).
+`design-first` (needs the full history) → `gofmt -l` → `go vet ./...` →
+`go test ./...` (main module, no e2e; includes the panel guard tests, see
+[§ Panel pages](#panel-pages-the-component-kit-and-its-guards)).
 
 ### `release.yml` — published GitHub Release, or `workflow_dispatch` with SemVer