Add 80% limit warning, stop repeat notifications, fix review findings

Notifications:
- Warn once when a counter reaches warn_percent of its limit, through
  separate warn_*_url endpoints.
- Write ntf/ markers so a lost Redis reply cannot re-send a breach.
- Retry only when the request never left or the web app answered 429/5xx.

Fixes:
- Retry transactions Redis rejected; treat pool timeouts as definite.
- Install the signal handler before startup work.
- Stop logging the login suffix; redact notify URL credentials.
- Reject corrupt or empty CDBs, truncated hash tables included.
- Require a Sentinel password, refuse example placeholders, and default
  admin_addr to localhost.
- Normalise /counters domains, count on the arrival day, log rejections,
  hide internals in errors and exit 1 on a failed drain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/counting/counting_test.go

@@ -450,7 +450,7 @@ func TestPlan_OutSenderUnusableCountsRecipient(t *testing.T) {
 }
 
 func TestPlan_OutRecipientUnusableCountsSender(t *testing.T) {
-	job := Job{Route: RouteOut, TraceID: "u2", AuthUser: "x@example.com", LoginSuffix: "SUPPORTTOKEN", MailFrom: "x@example.com",
+	job := Job{Route: RouteOut, TraceID: "u2", AuthUser: "x@example.com", TokenLogin: true, MailFrom: "x@example.com",
 		RecipientUnusable: Unusable{Role: "recipient", Value: "u@[192.0.2.1]", Reason: "invalid e-mail address"}}
 	plan, err := newPlanner(false).Plan(job)
 	if err != nil {
@@ -461,8 +461,8 @@ func TestPlan_OutRecipientUnusableCountsSender(t *testing.T) {
 		{"D", "example.com", "o", "x@example.com", 2200, true},
 		{"O", "7", "o", "x@example.com", 2200, true},
 	})
-	if plan.LoginSuffix != "SUPPORTTOKEN" || plan.AuthUser != "x@example.com" {
-		t.Errorf("login suffix not carried: %+v", plan)
+	if !plan.TokenLogin || plan.AuthUser != "x@example.com" {
+		t.Errorf("token login not carried: %+v", plan)
 	}
 	if len(plan.Unusable) != 1 || plan.Unusable[0].Role != "recipient" {
 		t.Errorf("unusable = %+v", plan.Unusable)