Phase 4: applications + SASL (sasldb2) + sender_login_maps

Adds application accounts bound to domains: a SASL login/password in
sasldb2, a per-application address mode (wildcard @domain or an explicit
list), and matching smtpd_sender_login_maps bindings — with create,
list, edit-mode, delete and password regeneration (spec 4.1, 5.1,
7.2.5-9). Generated passwords are shown exactly once and never stored in
plaintext (7.6.1).

- internal/store/applications.go: transactional CRUD; globally unique
  login; ListBindings (address->login) as the map source; logins-by-
  domain for pre-cascade SASL cleanup.
- internal/app: saslpasswd2 wrapper (password via stdin, login as a
  whitelisted argv element, no shell — 7.6.3); strong base64url password;
  address validation that enforces domain ownership before any config
  write (7.6.2); service orchestrating store + sasldb2 + map with full
  rollback on partial failure.
- internal/postfix: sender_login_maps regenerated as a pure function of
  the registry (many-to-one logins merged per address), atomic write,
  injection backstop (7.6.4).
- Postfix reload, corrected: `postfix start-fg` forks a separate master,
  so signalling the supervised process never reaches it. Reload now runs
  the canonical `postfix reload` via a one-shot supervisord program the
  unprivileged panel triggers over the group control socket. Verified in
  mail.log.
- domain.Service.Delete purges the domain's SASL accounts, then cascades,
  then rebuilds the sender map and reloads; manual reload now covers both
  OpenDKIM and Postfix.
- web: application management in the domain page, one-time credential
  shown inline; postfix joins the selfpost group and entrypoint normalises
  /data/sasl and /data/postfix (setgid, group-readable) with self-heal.

Verified on the dev server: gofmt/vet/test green, image builds, and a
container e2e covers the full application lifecycle, domain-delete
cascade, restart persistence, and a real postfix reload.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/app/validate_test.go

@@ -0,0 +1,92 @@
+package app
+
+import "testing"
+
+func TestValidateLogin(t *testing.T) {
+	good := []string{"alerts", "prod-server", "app_1", "News.Letter"}
+	for _, l := range good {
+		if err := validateLogin(l); err != nil {
+			t.Errorf("validateLogin(%q) = %v, want nil", l, err)
+		}
+	}
+	bad := []string{
+		"ab",                 // too short
+		"alerts@example.com", // '@' not allowed (sasldb realm separator)
+		"has space",          // whitespace
+		"inject\nline",       // newline
+		"comma,login",        // map value separator
+		"colon:login",        // config separator
+	}
+	for _, l := range bad {
+		if err := validateLogin(l); err == nil {
+			t.Errorf("validateLogin(%q) = nil, want error", l)
+		}
+	}
+}
+
+func TestValidateSenderAddressDomainOwnership(t *testing.T) {
+	// The critical check (spec 7.6.2): an address must belong to the app's domain.
+	if err := validateSenderAddress("alerts@example.com", "example.com"); err != nil {
+		t.Errorf("same-domain address rejected: %v", err)
+	}
+	if err := validateSenderAddress("alerts@evil.com", "example.com"); err == nil {
+		t.Error("cross-domain address accepted, want rejection")
+	}
+	// A trailing-domain trick must not pass as ownership.
+	if err := validateSenderAddress("a@notexample.com", "example.com"); err == nil {
+		t.Error("suffix-domain address accepted, want rejection")
+	}
+}
+
+func TestValidateSenderAddressForm(t *testing.T) {
+	bad := []string{
+		"noat.example.com",    // no '@'
+		"@example.com",        // empty local part
+		".dot@example.com",    // leading dot
+		"dot.@example.com",    // trailing dot
+		"in ject@example.com", // space
+		"quote\"@example.com", // disallowed char
+	}
+	for _, a := range bad {
+		if err := validateSenderAddress(a, "example.com"); err == nil {
+			t.Errorf("validateSenderAddress(%q) = nil, want error", a)
+		}
+	}
+}
+
+func TestParseAddresses(t *testing.T) {
+	// Normalises case, trims, drops blanks, de-duplicates.
+	got, err := parseAddresses([]string{" Alerts@Example.com ", "", "noreply@example.com", "alerts@example.com"}, "example.com")
+	if err != nil {
+		t.Fatalf("parseAddresses: %v", err)
+	}
+	if len(got) != 2 || got[0] != "alerts@example.com" || got[1] != "noreply@example.com" {
+		t.Fatalf("parseAddresses = %v", got)
+	}
+
+	// Empty list in list mode is an error.
+	if _, err := parseAddresses([]string{"", "  "}, "example.com"); err == nil {
+		t.Error("empty address list accepted, want error")
+	}
+	// A cross-domain address rejects the whole submission.
+	if _, err := parseAddresses([]string{"ok@example.com", "bad@other.com"}, "example.com"); err == nil {
+		t.Error("cross-domain address in list accepted, want error")
+	}
+}
+
+func TestGeneratePasswordStrength(t *testing.T) {
+	seen := make(map[string]bool)
+	for i := 0; i < 50; i++ {
+		p, err := generatePassword()
+		if err != nil {
+			t.Fatalf("generatePassword: %v", err)
+		}
+		if len(p) < 30 {
+			t.Fatalf("password too short: %d chars", len(p))
+		}
+		if seen[p] {
+			t.Fatalf("duplicate password generated: %q", p)
+		}
+		seen[p] = true
+	}
+}