Fix DMARC guidance for send-only relays with optional rua= settings.

The panel now suggests policy-only DMARC by default, lets operators configure a default and per-domain report address, and DNS-checks hub _report._dmarc records. Future in-panel report ingestion is tracked as dmarc-reports in the roadmap.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/web/validate_email_test.go

@@ -0,0 +1,18 @@
+package web
+
+import "testing"
+
+func TestValidateEmail(t *testing.T) {
+	if err := validateEmail(""); err != nil {
+		t.Errorf("empty: %v", err)
+	}
+	if err := validateEmail("reports@mail.example.com"); err != nil {
+		t.Errorf("valid: %v", err)
+	}
+	if err := validateEmail("bad"); err == nil {
+		t.Error("bad address accepted")
+	}
+	if err := validateEmail("x@gmail.com"); err == nil {
+		t.Error("gmail accepted")
+	}
+}