release: 1.1.0: Domain-admin role and internal/web package split

The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL packaging on every page, and an internal split of `internal/web` ahead of domain-admin work. Upgrading runs one SQLite migration (empty defaults; existing DNS guidance is unchanged until you set a report address).
Changed:
  - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
Added:
  - panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
  - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
  - [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel

Full detail: CHANGELOG.md (1.1.0).

internal/web/validate/validate_test.go

@@ -0,0 +1,67 @@
+package validate
+
+import "testing"
+
+func TestNormalizeDomain(t *testing.T) {
+	cases := map[string]string{
+		"  Example.COM ":   "example.com",
+		"MAIL.Example.Org": "mail.example.org",
+		"example.com":      "example.com",
+	}
+	for in, want := range cases {
+		if got := NormalizeDomain(in); got != want {
+			t.Errorf("NormalizeDomain(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestValidateDomainValid(t *testing.T) {
+	valid := []string{
+		"example.com",
+		"mail.example.com",
+		"a.co",
+		"sub-domain.example.co.uk",
+		"x1.y2.z3",
+		"1example.com",
+	}
+	for _, d := range valid {
+		if err := Domain(d); err != nil {
+			t.Errorf("Domain(%q) unexpected error: %v", d, err)
+		}
+	}
+}
+
+func TestValidateDomainInvalid(t *testing.T) {
+	invalid := []string{
+		"",
+		"localhost",
+		"example",
+		".example.com",
+		"example.com.",
+		"exa mple.com",
+		"example..com",
+		"-example.com",
+		"example-.com",
+		"example.com\n",
+		"exa*mple.com",
+		"exa_mple.com",
+		"Example.com",
+		"пример.рф",
+		"example.c/m",
+	}
+	for _, d := range invalid {
+		if err := Domain(d); err == nil {
+			t.Errorf("Domain(%q) = nil, want error", d)
+		}
+	}
+}
+
+func TestValidateDomainLongLabelRejected(t *testing.T) {
+	label := make([]byte, 64)
+	for i := range label {
+		label[i] = 'a'
+	}
+	if err := Domain(string(label) + ".com"); err == nil {
+		t.Error("expected error for over-long label")
+	}
+}