panel: show Settings credentials and DMARC side by side

Global administrators get two cards in the .split layout; domain-scoped
users keep the single narrow form.

Co-Authored-By: Claude <Composer 2.5> <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -5,6 +5,12 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
 
 ## [Unreleased]
 
+### Changed
+
+- panel: **Settings** shows panel credentials and DMARC aggregate reports side
+  by side for global administrators (the same `.split` layout as a delivery's
+  message and history). Domain-scoped users keep the single narrow card.
+
 ## [1.2.0] - 2026-08-11
 
 The second MINOR after 1.0.0: domain administrators with per-domain scope, a

internal/web/view/templates/account.html

@@ -1,14 +1,21 @@
+{{/* Wide enough for credentials and DMARC settings side by side (see .split
+     in panel.css, as on a delivery's page). */}}
+{{define "wide"}}wide{{end}}
+
 {{define "content"}}
 <h1>Settings</h1>
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
+{{if .Error}}<p class="error">{{.Error}}</p>{{end}}
 
-<div class="card narrow">
+{{if .ShowDMARC}}
+<form method="post" action="/account">
+<div class="split">
+  <div class="card">
     <h2>Panel credentials</h2>
     <p class="muted">These are the credentials for this control panel only.
     Applications keep their own logins and passwords, which are not affected.</p>
-  {{if .Error}}<p class="error">{{.Error}}</p>{{end}}
-  <form method="post" action="/account">
+
     <label for="username">Username</label>
     <input id="username" name="username" autocomplete="username"
            autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
@@ -22,9 +29,10 @@
 
     <label for="new_password_confirm">Confirm new password</label>
     <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
+  </div>
 
-    {{if .ShowDMARC}}
-    <h3>DMARC aggregate reports</h3>
+  <div class="card">
+    <h2>DMARC aggregate reports</h2>
     <p class="muted">Optional default <code>rua=</code> address for every sending
     domain (can be overridden per domain). Use a mailbox on a domain that
     receives inbound mail. SelfPost is send-only today; a future release will
@@ -59,12 +67,39 @@
 {{end}}</span>{{end}}
     {{end}}
     {{end}}
-    {{end}}
+  </div>
+</div>
+
+<button type="submit">Save changes</button>
+<p class="muted">Leave both new-password fields empty to change the username
+or DMARC address only. Changing the password signs out every other session;
+this one stays signed in.</p>
+</form>
+{{else}}
+<div class="card narrow">
+  <h2>Panel credentials</h2>
+  <p class="muted">These are the credentials for this control panel only.
+  Applications keep their own logins and passwords, which are not affected.</p>
+  <form method="post" action="/account">
+    <label for="username">Username</label>
+    <input id="username" name="username" autocomplete="username"
+           autocapitalize="none" spellcheck="false" value="{{.FormUsername}}" required>
+
+    <label for="current_password">Current password</label>
+    <input id="current_password" name="current_password" type="password"
+           autocomplete="current-password" required>
+
+    <label for="new_password">New password</label>
+    <input id="new_password" name="new_password" type="password" autocomplete="new-password">
+
+    <label for="new_password_confirm">Confirm new password</label>
+    <input id="new_password_confirm" name="new_password_confirm" type="password" autocomplete="new-password">
 
     <button type="submit">Save changes</button>
   </form>
   <p class="muted">Leave both new-password fields empty to change the username
-  {{if .ShowDMARC}}or DMARC address {{end}}only. Changing the password signs out every other session;
+  only. Changing the password signs out every other session;
   this one stays signed in.</p>
 </div>
 {{end}}
+{{end}}

internal/web/view/templates_test.go

@@ -263,7 +263,7 @@ func TestOnlyThePagesMadeOfDataDeclareThemselvesWide(t *testing.T) {
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
-	wide := map[string]bool{"deliveries": true, "delivery": true, "mail_queue": true, "system_log": true}
+	wide := map[string]bool{"account": true, "deliveries": true, "delivery": true, "mail_queue": true, "system_log": true}
 	for name, page := range engine.Pages() {
 		var buf bytes.Buffer
 		if err := page.ExecuteTemplate(&buf, "wide", nil); err != nil {