The server sends every objectList as a map keyed by index, not an array,
so the summary cards threw on real reports (records, DKIM and SPF
results, TLS policies and failures). Read them with jmapMapToArray, skip
a report without a policy domain, and show anything unexpected as an
error in the card instead of breaking the page.