app: the sender map's rebuild is serialised (audit W3)

Security audit 2026-10-17, finding W3 (low), stage 1. Resync read the
bindings and wrote the map with no lock (the selector table has tableMu);
two application changes at once could write in the order opposite to their
reads and leave the map stale - an application whose binding was missing
refused with reject_sender_login_mismatch until the next change. Now a
mutex on the Service holds the read, the write and the reload together.

Test: TestResyncRunsOneAtATime (eight at once, never two inside the
rebuild).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security-audit-2026-10-17.md

@@ -750,8 +750,8 @@ the argument.
   **Sonnet**, 0.5 h. *Done 2026-10-17:* in `store.DeleteDomain`, one
   transaction with the domain; TestDeletingADomainDeletesItsReports. (The `domain_id` form is better and 2 h; take it if
   stage 1 is split across two sittings.)
-- [ ] **W3.** A mutex around `Resync`'s read + write + reload. — **Sonnet**,
-  0.5 h.
+- [x] **W3.** A mutex around `Resync`'s read + write + reload. — **Sonnet**,
+  0.5 h. *Done 2026-10-17:* TestResyncRunsOneAtATime.
 
 ### Stage 2 — the key group (~2.5 h) → patch release, then the test server's `certs/`