Fix #4-#8: mail virtual domains, DNS verified, reseller isolation, missing DB tables

#4: Postfix virtual mailbox config (virtual_mailbox_domains/maps, vmail user, maildir
    at /var/mail/vhosts/%d/%n). Dovecot SQL backend pointed at novacpx.email_accounts
    with SHA512-CRYPT passdb and per-domain Maildir userdb.

#5: BIND9 confirmed working — dig @localhost resolves testdomain1.com correctly.

#6: Certbot 2.9.0 confirmed installed; domains.document_root wired; infrastructure
    ready for live domain issuance (testdomain1.com not publicly resolvable so
    dry-run expected to fail).

#7: Fixed all broken user-panel API queries — missing tables (databases, ftp_accounts,
    ssl_certs, cron_jobs, php_configs, notifications) created; `databases` reserved-word
    backtick-quoted across DatabaseManager+endpoints; domains.php is_primary→type=main,
    doc_root→document_root column fixes; DNSManager::createZone call signature fixed;
    stats/account auto-resolves account_id for user role.

#8: assert_account_access() helper added to api/index.php; reseller ownership check
    wired into email, ftp, databases, domains, dns, ssl endpoints.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tools/nova-logs.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# nova-logs.sh — Stream/view NovaCPX logs from VM
+# Usage: bash nova-logs.sh [apache|access|install|fail2ban|all]
+#   (no arg) : apache error log (default)
+
+PVE1_HOST="orbisne.fortiddns.com"
+PVE1_PASS="Joker1974!!!"
+VM_IP="10.48.200.110"
+VM_PASS="Joker1974!!!"
+SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=10"
+
+TARGET="${1:-apache}"
+
+case "$TARGET" in
+  apache)   LOG_CMD="tail -f /var/log/apache2/error.log" ;;
+  access)   LOG_CMD="tail -f /var/log/novacpx/access.log" ;;
+  install)  LOG_CMD="tail -100 /var/log/novacpx-install.log" ;;
+  fail2ban) LOG_CMD="tail -f /var/log/fail2ban.log" ;;
+  all)      LOG_CMD="tail -f /var/log/apache2/error.log /var/log/novacpx/access.log" ;;
+  *)        echo "Unknown log: $TARGET. Options: apache|access|install|fail2ban|all"; exit 1 ;;
+esac
+
+echo "Streaming $TARGET logs from VM $VM_IP..."
+echo "(Ctrl+C to stop)"
+echo ""
+
+sshpass -p "$PVE1_PASS" ssh -t $SSH_OPTS root@$PVE1_HOST \
+  "sshpass -p '$VM_PASS' ssh -t $SSH_OPTS root@$VM_IP '$LOG_CMD'"