Add Administration, starting with accounts

An account whose Stalwart role manages accounts now finds Administration in
the account menu. It lists, searches, creates and edits accounts -- display
name, other addresses, role, storage limit -- sets a new password, and
deletes, each offered only when the role holds the matching permission.

The server keeps the permissions list from GET /api/account, which it
already called for the edition and threw the rest away. Everything else is
JMAP x:Account, x:Domain and x:Role calls through the existing /api/jmap
proxy, so nothing new is stored and Stalwart decides every call.

Stalwart checks a grant against the caller's permissions but not a password
change or a delete, so an account that outranks the viewer is shown
read-only. Your own password is changed in Settings, which re-seals the
session; changing it here would strand it.

The mock server gains a directory behind the same permission names, with
MOCK_ROLE choosing admin, tenant-admin, helpdesk or user.

68 new strings, translated in all nine catalogues; strings falling back to
English stay at 16.

web/src/locales/zh-Hans.ts

@@ -45,6 +45,75 @@ import type { Catalog } from "@/lib/i18n";
  */
 export const catalog: Catalog = {
   strings: {
+    // ── Administration: accounts ───────────────────────────────────
+    "Change your own password in {settings}.": "请在{settings}中更改您自己的密码。",
+    "Administration": "管理",
+    "Directory": "目录",
+    "User": "用户",
+    "Administrator": "管理员",
+    "Custom role": "自定义角色",
+    "New account": "新建账户",
+    "The people who sign in to mail on the domains you manage.": "在您管理的域名上登录邮箱的人员。",
+    "Search by name or address": "按姓名或地址搜索",
+    "Search accounts": "搜索账户",
+    "No accounts match": "没有匹配的账户",
+    "No accounts yet": "暂无账户",
+    "Nothing on your domains matches “{query}”.": "您的域名中没有与「{query}」匹配的内容。",
+    "Open {address}": "打开 {address}",
+    "{from}–{to} of {total}": "第 {from}–{to} 个，共 {total} 个",
+    "Previous page": "上一页",
+    "Next page": "下一页",
+    "Storage": "存储",
+    "Groups": "群组",
+    "{used} · no limit": "{used} · 无限制",
+    "Profile": "资料",
+    "Domain": "域名",
+    "No domains are available to create an account on.": "没有可用于创建账户的域名。",
+    "Sign-in": "登录",
+    "Other addresses": "其他地址",
+    "Not in any group": "不属于任何群组",
+    "You can't change your own role.": "您无法更改自己的角色。",
+    "Only roles whose permissions you hold yourself are offered. On an account inside a tenant, Administrator means administrator of that tenant.": "仅提供您本人拥有其全部权限的角色。对于租户内的账户，管理员指的是该租户的管理员。",
+    "Limit in GB": "限额（GB）",
+    "No limit": "无限制",
+    "This account has permissions yours doesn't, so you can view it but not change it.": "该账户拥有您的账户所没有的权限，因此您只能查看，无法更改。",
+    "Your role lets you view accounts but not change them.": "您的角色可以查看账户，但不能更改。",
+    "This account has permissions yours doesn't.": "该账户拥有您的账户所没有的权限。",
+    "You can't delete the account you're signed in with.": "您无法删除当前登录的账户。",
+    "Create account": "创建账户",
+    "An account needs an address.": "账户需要一个地址。",
+    "Created {address}": "已创建 {address}",
+    "Saved {address}": "已保存 {address}",
+    "Generate a password": "生成密码",
+    "Pass it on some way other than email to this address.": "请通过发往此地址的邮件以外的方式转交。",
+    "This account has no password. It may sign in through a directory or single sign-on.": "该账户没有密码，可能通过目录服务或单点登录进行登录。",
+    "Set a new password…": "设置新密码…",
+    "{name} will be signed out of every app and device using the old password.": "{name} 将在所有使用旧密码的应用和设备上被退出登录。",
+    "New password set for {address}": "已为 {address} 设置新密码",
+    "Set password": "设置密码",
+    "Remove {address}": "移除 {address}",
+    "New address": "新地址",
+    "another name": "其他名称",
+    "Mail to these addresses is delivered to this account. Changes apply when you save.": "发往这些地址的邮件会投递到此账户。更改在保存后生效。",
+    "Deletes the mailbox and everything in it.": "删除邮箱及其中的全部内容。",
+    "Delete account…": "删除账户…",
+    "Delete {address}?": "删除 {address}？",
+    "This deletes the mail, calendars, contacts and files in this account. The server removes them in the background, and it can't be undone.": "这将删除此账户中的邮件、日历、联系人和文件。服务器会在后台移除它们，且无法撤销。",
+    "Type {address} to confirm": "输入 {address} 以确认",
+    "Delete account": "删除账户",
+    "Deleted {address}": "已删除 {address}",
+    "The server did not say whether the account was created.": "服务器没有说明账户是否已创建。",
+    "The mail server refused this. Your role may not allow it.": "邮件服务器拒绝了此操作。您的角色可能不允许。",
+    "The mail server refused this: {reason}": "邮件服务器拒绝了此操作：{reason}",
+    "That address is already in use on this server, as an account, a list or an alias.": "该地址已在此服务器上被账户、列表或别名使用。",
+    "One of the chosen domain, role or group can't be used for this account.": "所选的域名、角色或群组无法用于此账户。",
+    "Your organisation has reached the number of accounts it is allowed.": "您的组织已达到允许的账户数量上限。",
+    "Something still depends on this, so the server kept it.": "仍有其他内容依赖于它，因此服务器保留了它。",
+    "This account no longer exists. Someone may have deleted it.": "该账户已不存在，可能已被他人删除。",
+    "The password was not accepted: {reason}": "密码未被接受：{reason}",
+    "The password was not accepted.": "密码未被接受。",
+    "The mail server rejected a value: {reason}": "邮件服务器拒绝了一个值：{reason}",
+    "The mail server rejected a value.": "邮件服务器拒绝了一个值。",
     "Go to folder…": "转到文件夹…",
     "Set for everyone here. You cannot change this.": "已为此处所有人设定，您无法更改。",
     "Export iCAL file": "导出 iCAL 文件",
@@ -1355,6 +1424,8 @@ export const catalog: Catalog = {
     "no address": "无地址",
   },
   plurals: {
+    // ── Administration ────────────────────────────────────────────────
+    "{n} accounts": { other: "{n} 个账户" },
     // ── Third pass ─────────────────────────────────────────────────────
     "Delete {n} items": { other: "删除 {n} 个项目" },
     "Delete {n} items?": { other: "要删除 {n} 个项目吗？" },