Add 80% limit warning, stop repeat notifications, fix review findings

Notifications:
- Warn once when a counter reaches warn_percent of its limit, through
  separate warn_*_url endpoints.
- Write ntf/ markers so a lost Redis reply cannot re-send a breach.
- Retry only when the request never left or the web app answered 429/5xx.

Fixes:
- Retry transactions Redis rejected; treat pool timeouts as definite.
- Install the signal handler before startup work.
- Stop logging the login suffix; redact notify URL credentials.
- Reject corrupt or empty CDBs, truncated hash tables included.
- Require a Sentinel password, refuse example placeholders, and default
  admin_addr to localhost.
- Normalise /counters domains, count on the arrival day, log rejections,
  hide internals in errors and exit 1 on a failed drain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/txlog/txlog_test.go

@@ -295,7 +295,7 @@ func TestErrorLine(t *testing.T) {
 // --- review round 1 lines -----------------------------------------------------
 
 func TestRequestLine_LoginSuffixAndUnusable(t *testing.T) {
-	plan, err := planner().Plan(counting.Job{Route: counting.RouteOut, TraceID: "m1", AuthUser: "x@wearemiraclesnow.com", LoginSuffix: "SUPPORTTOKEN",
+	plan, err := planner().Plan(counting.Job{Route: counting.RouteOut, TraceID: "m1", AuthUser: "x@wearemiraclesnow.com", TokenLogin: true,
 		MailFrom: "x@wearemiraclesnow.com", MailFromUsable: true,
 		RecipientUnusable: counting.Unusable{Role: "recipient", Value: "u@[192.0.2.1]", Reason: "invalid e-mail address"}})
 	if err != nil {
@@ -304,7 +304,7 @@ func TestRequestLine_LoginSuffixAndUnusable(t *testing.T) {
 	l, buf := newLogger("text")
 	l.Outcome(outcome(plan, 1, 1, 1), nil)
 	got := buf.String()
-	if !strings.Contains(got, ts+" <m1> out; request auth_user=x@wearemiraclesnow.com recipient= mail_from=x@wearemiraclesnow.com login_suffix=SUPPORTTOKEN\n") {
+	if !strings.Contains(got, ts+" <m1> out; request auth_user=x@wearemiraclesnow.com recipient= mail_from=x@wearemiraclesnow.com token_login=true\n") {
 		t.Errorf("request line should show the login suffix:\n%s", got)
 	}
 	if !strings.Contains(got, ts+" <m1> out; recipient address not usable: u@[192.0.2.1] (invalid e-mail address, not counted)\n") {
@@ -318,7 +318,7 @@ func TestRequestLine_LoginSuffixAndUnusable(t *testing.T) {
 		SenderUnusable: counting.Unusable{Role: "sender", Reason: "missing"}})
 	l, buf = newLogger("text")
 	l.Outcome(outcome(plan, 1, 1, 1), nil)
-	if got := buf.String(); !strings.Contains(got, " <m2> out; sender address not usable: <empty> (missing, not counted)\n") || strings.Contains(got, "login_suffix") {
+	if got := buf.String(); !strings.Contains(got, " <m2> out; sender address not usable: <empty> (missing, not counted)\n") || strings.Contains(got, "token_login") {
 		t.Errorf("missing sender line / unexpected suffix:\n%s", got)
 	}
 
@@ -411,3 +411,21 @@ func (m malformedTable) Lookup(d string) (*domains.Domain, error) {
 	}
 	return m.table.Lookup(d)
 }
+
+func TestNotificationLines_RedactCredentials(t *testing.T) {
+	l, buf := newLogger("text")
+	ev := notify.Event{TraceID: "t", Route: "out", Level: "O"}
+	l.NotificationSent(ev, "https://api:s3cret@admin.example/api/limits?level=O", 1)
+	l.NotificationFailed(ev, "https://api:s3cret@admin.example/api/limits?level=O", 2, errors.New("boom"))
+	if got := buf.String(); strings.Contains(got, "s3cret") || !strings.Contains(got, "api:xxxxx@admin.example/api/limits?level=O") {
+		t.Errorf("log:\n%s", got)
+	}
+}
+
+func TestRejected(t *testing.T) {
+	l, buf := newLogger("text")
+	l.Rejected("in", "tr9", 400, "recipient: missing")
+	if got, want := buf.String(), ts+" <tr9> in; rejected: 400 recipient: missing (not counted)\n"; got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}