release: 1.1.0: Domain-admin role and internal/web package split

The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL packaging on every page, and an internal split of `internal/web` ahead of domain-admin work. Upgrading runs one SQLite migration (empty defaults; existing DNS guidance is unchanged until you set a report address).
Changed:
  - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
Added:
  - panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
  - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
  - [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel

Full detail: CHANGELOG.md (1.1.0).

internal/web/auth/token.go

@@ -0,0 +1,20 @@
+package auth
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+)
+
+// randomToken returns a URL-safe token with at least nBytes*8 bits of entropy
+// drawn from crypto/rand. Setup and session tokens both use this; the setup
+// token needs >=128 bits (security.md), so callers pass nBytes >= 16.
+//
+// It panics if the system RNG fails: that is unrecoverable and must never be
+// papered over with a weak fallback for a security token.
+func randomToken(nBytes int) string {
+	b := make([]byte, nBytes)
+	if _, err := rand.Read(b); err != nil {
+		panic("crypto/rand failed: " + err.Error())
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}