release: 1.1.0: Domain-admin role and internal/web package split

The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL packaging on every page, and an internal split of `internal/web` ahead of domain-admin work. Upgrading runs one SQLite migration (empty defaults; existing DNS guidance is unchanged until you set a report address).
Changed:
  - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
Added:
  - panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
  - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
  - [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel

Full detail: CHANGELOG.md (1.1.0).

internal/domain/transfer_test.go

@@ -1,6 +1,7 @@
 package domain
 
 import (
+	"database/sql"
 	"errors"
 	"fmt"
 	"testing"
@@ -72,6 +73,9 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if _, err := src.store.AddApplication(d.ID, "alerts", store.AddressModeList, []string{"a@example.com"}); err != nil {
 		t.Fatalf("add alerts: %v", err)
 	}
+	if err := src.store.UpdateDomainDMARCRua(d.ID, sql.NullString{Valid: true, String: "reports@hub.example"}); err != nil {
+		t.Fatalf("set dmarc rua: %v", err)
+	}
 
 	exp, err := src.Export(d.ID)
 	if err != nil {
@@ -107,6 +111,12 @@ func TestExportImportRoundTrip(t *testing.T) {
 	if got.Name != "example.com" || got.DKIMSelector != "selfpost" {
 		t.Errorf("imported domain = %+v", got)
 	}
+	if !got.DMARCRua.Valid || got.DMARCRua.String != "reports@hub.example" {
+		t.Errorf("imported dmarc rua = %+v", got.DMARCRua)
+	}
+	if exp.DMARCRua == nil || *exp.DMARCRua != "reports@hub.example" {
+		t.Errorf("exported dmarc rua = %v", exp.DMARCRua)
+	}
 	// The DKIM key was imported byte-for-byte, so the DNS record is unchanged.
 	dstKey, err := dstOdk.ExportKey("example.com", "selfpost")
 	if err != nil {