Phase 9: full backup/restore + domain export/import (spec 7.5, 11.6)

Full server backup (spec 7.5.A): internal/backup produces a tar.gz of all of
/data — a consistent SQLite snapshot via VACUUM INTO, DKIM keys, sasldb2 and a
version manifest; TLS certs (tls/) and the Postfix queue are excluded. Two equal
paths: the panel button (POST /backup, no-store) and the selfpost-backup CLI via
docker exec (spec 11.6). CheckRestore runs before store.Open: a manifest version
mismatch refuses to boot with the image tag to use; a match consumes the
manifest so it only guards the first post-restore boot. Restore is not a
separate branch — Postfix/OpenDKIM regenerate from the restored SQLite as on any
start.

Domain export/import (spec 7.5.B): DomainExport carries the DKIM private key and
each application's working password. SASL secrets are read from sasldb2 via
db_dump (the userPassword property is plaintext) and, on import, re-keyed under
the local realm with saslpasswd2 — so credentials keep working on an instance
with a different hostname, with no DKIM DNS change. Import validates and rolls
back atomically on any failure. db-util (db_dump) is now an explicit image dep.

Verified on the server (selfpost:p9): gofmt/vet/test green; container e2e for
cross-realm domain export/import (SMTP AUTH 235 under the new realm), CLI and
panel backups, same-version restore, and version-mismatch refusal.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/app/service.go

@@ -92,6 +92,38 @@ func (s *Service) rollbackCreate(id int64, login string) {
 	_, _ = s.store.DeleteApplication(id)
 }
 
+// ImportApplication re-creates an application from a domain-export file (spec
+// 7.5.B): it validates the login and (in list mode) that every address belongs
+// to the domain, inserts the registry row and writes the SASL account with the
+// imported password verbatim, re-keyed under this instance's realm so the
+// credential keeps working without regeneration. It deliberately does not
+// rebuild the sender map — the caller (domain import) does that once after all
+// applications are in — and returns store.ErrLoginExists if the login collides.
+func (s *Service) ImportApplication(domainID int64, login, mode string, rawAddresses []string, password string) error {
+	addresses, err := s.validateForDomain(domainID, login, mode, rawAddresses)
+	if err != nil {
+		return err
+	}
+	if err := validateImportedPassword(password); err != nil {
+		return err
+	}
+	a, err := s.store.AddApplication(domainID, login, mode, addresses)
+	if err != nil {
+		return err // ErrLoginExists surfaces to the caller as a friendly message
+	}
+	if err := s.sasl.Set(login, password); err != nil {
+		_, _ = s.store.DeleteApplication(a.ID)
+		return err
+	}
+	return nil
+}
+
+// Secret returns an application's stored password for a domain export (spec
+// 7.5.B). See SASLDB.Secret for why this is possible and safe.
+func (s *Service) Secret(login string) (string, error) {
+	return s.sasl.Secret(login)
+}
+
 // UpdateMode switches an application's address mode / list and rebuilds the
 // sender map (spec 7.2.7). The login and password are untouched. Addresses are
 // re-validated against the application's domain.