Goal

Implement the UX feedback batch from live smoke testing (iCloud end-to-end works; IMAP/TLS/ACME track alongside in 70790ed). One session per issue, in the order below. Related: 70790ed (smoke), 6ca5959 (multi-MX), 3726817 (DID mapping), 16df68d (imap/smtp endpoints).

Build order

1. d656998 — HTMX v4 foundation (vendored 4.0.0, HX-Request fragments, user-facing error catalog, no-JS fallbacks). Unblocks 2 + 4.
2. 4f7a69b — Inline mailbox creation on domain page (needs 1). 6663bc8 — Account page cleanup: secret under App Passwords + OK dismiss, expiry rows, delete with native confirm (needs 1). These two are independent of each other once 1 lands.
3. 4611274 (+ addendum 4a621d1) — per-field DNS copy + recheck + collapsed <details> when active with verified_at in fresh schema. 6651065 — bare-local-part mailbox shorthand (lowercase+trim, ErrDomainMismatch → 400). 58db1bc — chunked app-password display
   • copy, never expire. Independent; any order.
4. f197c0a — handle typeahead (login now; 3726817 input later).
5. Design tracks (parallel, no code): 3726817 (DID mapping incl. PDS hosting cases), 16df68d (imap./smtp. endpoints), 6ca5959 (multi-MX/failover).

Cross-cutting notes (locked)

• No table migrations: dev + smoke tables get blown away; schema changes (verified_at, future DID work) go in fresh. Live tests of schema issues need a fresh environment.
• Native confirm() for deletes; no-JS fallbacks kept wherever possible.
• Passwords never expire; entropy never weakened (server-generated).
• Only tenant owners reassign mailbox DIDs (3726817).

Per-session checklist

• bug agent read <id> for the issue + comments.
• Failing test / stub first where logic is involved (prober, normalize, handlers via ui_test.go patterns; shellcheck + stub-JMAP for any deployment script touch).
• go vet/gofmt, SOVRN_INTEGRATION=0 go test ./..., YAML sweep + ansible --syntax-check if deployment touched.
• Comment progress on the issue; do not close until reviewed.