feat: items #9-13 — password change, webmail SSO, DKIM live, file manager security, cache busting

#9  auth.php: add self-service change-password action (current+new+confirm)
    accounts.php: fix admin change-password — accept account_id, fetch username
    for chpasswd (was using int ID), add Auth::require('admin') guard
    user.js: add Change Password page + navItem + submitChangePassword()

#10 EmailManager: store AES-256-CBC enc_password alongside SHA512-CRYPT hash
    webmail.php: rewrite login-url to use webmail_sso_tokens table
    novacpx-sso.php: Roundcube SSO bridge (validate token, decrypt, autosubmit)
    Migration 005: add enc_password column + webmail_sso_tokens table

#11 opendkim: installed, configured (/etc/opendkim.conf, signing.table,
    key.table, trusted.hosts), socket at /var/spool/postfix/opendkim/,
    Postfix milter wired, service enabled+running, key generation verified

#12 files.php: fix safe_path() for non-existent paths (write/mkdir),
    add safe_path_new() helper using parent-dir realpath check,
    fix delete guard (block deleting account root dirs),
    fix rename destination, clamp chmod to 0777

#13 nova.js: api() handles network errors, 429 rate-limit with retry-after,
    non-JSON responses (PHP fatal pages) — graceful error instead of throw
    admin/user/reseller index.php: filemtime-based cache-busting on all assets

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

db/migrations/003_proxy_hosts.sql

@@ -0,0 +1,19 @@
+-- Migration 003: Nginx Proxy Hosts table
+CREATE TABLE IF NOT EXISTS proxy_hosts (
+  id           INT AUTO_INCREMENT PRIMARY KEY,
+  account_id   INT UNSIGNED DEFAULT NULL,
+  domain       VARCHAR(255) NOT NULL,
+  upstream     VARCHAR(500) NOT NULL DEFAULT 'http://127.0.0.1:80',
+  ssl_enabled  TINYINT(1)   NOT NULL DEFAULT 0,
+  enabled      TINYINT(1)   NOT NULL DEFAULT 1,
+  custom_config TEXT         DEFAULT NULL,
+  notes        VARCHAR(500) DEFAULT NULL,
+  created_at   DATETIME     DEFAULT CURRENT_TIMESTAMP,
+  updated_at   DATETIME     DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
+  INDEX (account_id),
+  UNIQUE KEY uq_domain (domain)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Panel settings for proxy mode
+INSERT INTO settings (`key`, `value`) VALUES ('proxy_mode', 'disabled') ON DUPLICATE KEY UPDATE `key`=`key`;
+INSERT INTO settings (`key`, `value`) VALUES ('proxy_auto_sync', '0') ON DUPLICATE KEY UPDATE `key`=`key`;