Add Roles to Administration, with Stalwart's permissions in every language

A role is a named set of permissions given to accounts, groups and
tenants. It gets its own section under a new Access heading: every role
listed with the permissions it grants once its bases are followed, and a
panel to create, edit and delete one.

A role builds on others and has everything they grant; a denial anywhere in
the tree wins, which is how Stalwart resolves it (permissions.rs unions
enabled and disabled across the tree, then subtracts). The picker is
Stalwart's own list of permissions, under its headings, searchable and
filterable to what is granted or set here. Each permission is not set,
allowed or denied, and one that is inherited says which role it comes from.
Only permissions the viewer holds can be allowed, because Stalwart refuses
the rest, and a role carrying anything the viewer lacks opens read-only with
no delete, because Stalwart checks a grant but not a delete. Saving sends a
pointer for each permission and base role that changed.

The roles Stalwart hands out by default, read from x:Authentication, say so
before they are changed and cannot be deleted here; a role still in use is
kept by the server, and the refusal names what uses it.

The permission list is Stalwart's schema. A new route, GET
/api/admin/permissions, fetches /api/schema as the signed-in account and
returns only names and labels, behind the same two gates as the registry
methods and held in memory for an hour. Its labels are English only, so
every one of the 661 has a translation in each of the eight other
languages, in its own file keyed by permission name and loaded only when
Roles opens. A permission a later Stalwart adds shows its English label. A
test holds every language to the 0.16.22 snapshot: nothing missing, nothing
stale.

The mock answers x:Role/set with the grant check, loops and in-use
refusals, reads the defaults from x:Authentication, and serves the schema
gzipped as the real one is.

Fifty-two new strings and two plurals in all nine catalogues, and 661
permission labels with 59 headings in each of the eight translations.

web/src/lib/adminDirectory.ts

@@ -229,7 +229,7 @@ const VALIDATOR_MESSAGES: Record<string, () => string> = {
 };
 
 /** What kind of thing a refusal was about, where the wording has to differ. */
-export type DirectoryObject = "account" | "domain" | "group" | "list";
+export type DirectoryObject = "account" | "domain" | "group" | "list" | "role";
 
 /**
  * Say what went wrong in terms of the person's own action, in their language.
@@ -261,7 +261,9 @@ export function describeDirectoryError(err: unknown, object: DirectoryObject = "
   const description = err.description ?? "";
   switch (err.type) {
     case "forbidden":
-      if (/not authorized to grant/i.test(description)) return t("You can't give an account permissions your own role doesn't have.");
+      if (/not authorized to grant/i.test(description)) {
+        return object === "role" ? t("You can't give a role permissions your own role doesn't have.") : t("You can't give an account permissions your own role doesn't have.");
+      }
       if (/external directory/i.test(description)) return t("This account signs in through an external directory, so its password can't be set here.");
       if (/licen[cs]ed account limit/i.test(description)) return t("The server's licence allows no more accounts.");
       return t("The mail server refused this. Your role may not allow it.");
@@ -278,7 +280,9 @@ export function describeDirectoryError(err: unknown, object: DirectoryObject = "
           ? t("Your organisation has reached the number of groups it is allowed.")
           : object === "list"
             ? t("Your organisation has reached the number of mailing lists it is allowed.")
-            : t("Your organisation has reached the number of accounts it is allowed.");
+            : object === "role"
+              ? t("Your organisation has reached the number of roles it is allowed.")
+              : t("Your organisation has reached the number of accounts it is allowed.");
     case "objectIsLinked":
       return t("Something still depends on this, so the server kept it.");
     case "notFound":
@@ -288,7 +292,9 @@ export function describeDirectoryError(err: unknown, object: DirectoryObject = "
           ? t("This group no longer exists. Someone may have deleted it.")
           : object === "list"
             ? t("This mailing list no longer exists. Someone may have deleted it.")
-            : t("This account no longer exists. Someone may have deleted it.");
+            : object === "role"
+              ? t("This role no longer exists. Someone may have deleted it.")
+              : t("This account no longer exists. Someone may have deleted it.");
     case "rateLimit":
       return t("Too many attempts. Please wait a few minutes and try again.");
     case "tooLarge":