Add Administration, starting with accounts

An account whose Stalwart role manages accounts now finds Administration in
the account menu. It lists, searches, creates and edits accounts -- display
name, other addresses, role, storage limit -- sets a new password, and
deletes, each offered only when the role holds the matching permission.

The server keeps the permissions list from GET /api/account, which it
already called for the edition and threw the rest away. Everything else is
JMAP x:Account, x:Domain and x:Role calls through the existing /api/jmap
proxy, so nothing new is stored and Stalwart decides every call.

Stalwart checks a grant against the caller's permissions but not a password
change or a delete, so an account that outranks the viewer is shown
read-only. Your own password is changed in Settings, which re-seals the
session; changing it here would strand it.

The mock server gains a directory behind the same permission names, with
MOCK_ROLE choosing admin, tenant-admin, helpdesk or user.

68 new strings, translated in all nine catalogues; strings falling back to
English stay at 16.

web/src/views/admin/usePermissions.ts

@@ -0,0 +1,16 @@
+import { useMemo } from "react";
+import { useSession } from "@/store/session";
+import { permissionSet, type Permissions } from "@/lib/adminAccess";
+
+/**
+ * The signed-in account's permissions, as a set, stable between renders.
+ *
+ * Keyed on the contents, not the array. The session is fetched again whenever
+ * a response carries a different session state, and each fetch brings a new
+ * array with the same names in it; a set rebuilt from identity would re-run
+ * everything that depends on it, whose requests could bring another refresh.
+ */
+export function usePermissions(): Permissions {
+  const key = useSession((s) => (s.session?.ihasmail?.permissions ?? []).join(","));
+  return useMemo(() => permissionSet(key ? key.split(",") : []), [key]);
+}