release: 1.1.0: Domain-admin role and internal/web package split

The first MINOR after 1.0.0: send-only DMARC guidance in the panel, AGPL packaging on every page, and an internal split of `internal/web` ahead of domain-admin work. Upgrading runs one SQLite migration (empty defaults; existing DNS guidance is unchanged until you set a report address).
Changed:
  - `internal/web` split into subpackages (`web/view`, `web/auth`, `web/validate`,
Added:
  - panel: DMARC guidance for send-only relays — the suggested `_dmarc` record
  - AGPL packaging hygiene: [NOTICE](NOTICE) names the copyright holder and the
  - [docs/roadmap.md](docs/roadmap.md) — candidate item **visual-style** (panel

Full detail: CHANGELOG.md (1.1.0).

internal/web/view/templates/status.html

@@ -0,0 +1,62 @@
+{{define "content"}}
+<h1>Server status</h1>
+
+{{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
+
+{{template "status_body" .}}
+
+<div class="card" id="hostname">
+  <h2>Hostname and reverse DNS <span class="st st-{{.PTR.Status}}">{{.PTR.Status}}</span></h2>
+  <p class="muted">Receiving servers check that the name this server announces
+  resolves to its address <em>and</em> that the address resolves back to the same
+  name (forward-confirmed reverse DNS). A missing or mismatched reverse record is
+  the most common reason self-hosted mail is rejected or scored as spam. The
+  reverse record is set at the hosting provider, not in the domain's DNS zone.</p>
+
+  <label>Server hostname</label>
+  <span class="code">{{if .Hostname}}{{.Hostname}}{{else}}(SELFPOST_HOSTNAME is not set){{end}}</span>
+
+  {{if .PTR.Records}}
+  <label>Forward and reverse lookup</label>
+  <span class="code">{{range .PTR.Records}}{{.}}
+{{end}}</span>
+  {{end}}
+
+  <p class="{{if eq .PTR.Status "ok"}}muted{{else}}error{{end}}">{{.PTR.Detail}}</p>
+
+  <form class="inline" method="post" action="/status/recheck">
+    <button type="submit">Re-check DNS</button>
+  </form>
+</div>
+
+<div class="card" id="configuration">
+  <h2>Configuration</h2>
+  <p class="muted">Regenerates the OpenDKIM and Postfix configuration from the
+  database and reloads both daemons. Use it if you edited the files by hand,
+  restored a backup, or the running configuration looks out of step with the
+  domain and application lists. It does not touch the mail queue or the TLS
+  certificate, and it is safe to run at any time.</p>
+  <form class="inline" method="post" action="/reload">
+    <button type="submit">Reload configuration</button>
+  </form>
+</div>
+{{end}}
+
+{{/* The status page's section index, shown in the navigation column (see the
+     "sections" block in layout.html). The first six cards are the ones the
+     polling fragment replaces on a timer; their ids are part of
+     status_body.html and do not change with the reading, so the links here hold
+     across a refresh. */}}
+{{define "sections"}}
+<div class="sections">
+  <p class="sections-title">On this page</p>
+  <a href="#overall">Overall</a>
+  <a href="#processes">Processes</a>
+  <a href="#machine">Machine</a>
+  <a href="#queue">Mail queue</a>
+  <a href="#certificate">TLS certificate</a>
+  <a href="#sockets">Milter sockets</a>
+  <a href="#hostname">Hostname and reverse DNS</a>
+  <a href="#configuration">Configuration</a>
+</div>
+{{end}}