Add Migadu domain admin with shared lists, compaction, and safer apply.

Build the Go API and React UI for managing domain denylist/allowlist/recipient
deny and spam settings, plus shared lists that import/apply across domains with
wildcard compaction, entry verification, and Migadu-friendly list encoding
(including per-domain recipient filtering and rejection bisect on apply).

.env.example

@@ -0,0 +1,26 @@
+# Server
+LISTEN_ADDR=:8080
+SESSION_SECRET=change-me-to-a-long-random-secret-at-least-32-chars
+DATABASE_PATH=data/migaduadmin.db
+COOKIE_SECURE=false
+
+# Migadu API (https://www.migadu.com/api/)
+# Username is your Migadu account email; password is the API key ("app-key").
+# `make dev` creates .env automatically; replace these before loading domains.
+MIGADU_USER=you@example.com
+MIGADU_API_KEY=your-migadu-api-key
+MIGADU_BASE_URL=https://api.migadu.com/v1
+
+# Auth: local | pangolin | both
+AUTH_MODE=both
+
+# Comma-separated CIDRs allowed to supply Pangolin SSO headers
+# (Remote-Email, Remote-User, Remote-Name, Remote-Role).
+TRUSTED_PROXIES=127.0.0.1/32,::1/128
+
+# After the first admin exists, registration stays closed unless true.
+REGISTRATION_OPEN=false
+
+# When true, unknown Pangolin SSO emails are auto-created as role=user.
+# First-ever user is always admin regardless of this setting.
+SSO_AUTO_PROVISION=false