audit 4: cards ordered by number, a notification owed to each recipient

The cards layout (owner, 2026-10-13; the mockup first, b90a2f0): box_open
writes data-order for a box with InCards and a number, and panel.css orders
by it up to twelve - Health's eight and the kit's three.
TestCardsBoxesCarryTheirNumberAsTheirOrder reads the rendered pages.

Notifications (owner, 2026-10-14): migration 0011, notify_addressees. open
sends a subject's first message to every recipient and records who was
handed it; followUp, on every check while the subject is open and still
wrong, hands it to the owed and untold who are still recipients; closed
sends the end to the told (all recipients for a subject from before the
table). Tests: a failed copy goes out at the next check, once; the hourly
ceiling holds one back; a user added mid-subject hears nothing of it.

Also in the roadmap, from the owner today: dns-record-collapse,
notification-mail-recheck, settings-save-row (agreed, design first).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 644 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/architecture.md

@@ -393,8 +393,15 @@ is sent; the operator's view is guide § Notifications.
   deleted domain's row goes with it.
 - **Said means sent.** A problem that arises while no user can be told, or
   while Postfix does not take the message, stays unsaid and is told at a
-  later check. Its ending, with nobody left to tell, is simply over. If one
-  recipient's copy fails and another's goes out, the subject is said.
+  later check. Its ending, with nobody left to tell, is simply over.
+- **Owed to each recipient** (since `2.5.4`, `notify_addressees`): the
+  subject's first message records who it was addressed to and who was
+  handed a copy; while the subject is open, every later check hands it to
+  those not told yet - a copy that failed, or that the ceiling held back -
+  who are still recipients. A user who comes to hear of a subject only while
+  it is open is not mailed about it, and its ending goes to those who were
+  told. A subject opened before `2.5.4` has no such record, and its ending
+  goes to every recipient, as it did.
 - **The notifier's own mail is not a subject.** A notification waiting for a
   mailbox that does not answer, or its bounce coming back to
   `postmaster@<hostname>` - which receives no mail - is left out of the