Add Roles to Administration, with Stalwart's permissions in every language

A role is a named set of permissions given to accounts, groups and
tenants. It gets its own section under a new Access heading: every role
listed with the permissions it grants once its bases are followed, and a
panel to create, edit and delete one.

A role builds on others and has everything they grant; a denial anywhere in
the tree wins, which is how Stalwart resolves it (permissions.rs unions
enabled and disabled across the tree, then subtracts). The picker is
Stalwart's own list of permissions, under its headings, searchable and
filterable to what is granted or set here. Each permission is not set,
allowed or denied, and one that is inherited says which role it comes from.
Only permissions the viewer holds can be allowed, because Stalwart refuses
the rest, and a role carrying anything the viewer lacks opens read-only with
no delete, because Stalwart checks a grant but not a delete. Saving sends a
pointer for each permission and base role that changed.

The roles Stalwart hands out by default, read from x:Authentication, say so
before they are changed and cannot be deleted here; a role still in use is
kept by the server, and the refusal names what uses it.

The permission list is Stalwart's schema. A new route, GET
/api/admin/permissions, fetches /api/schema as the signed-in account and
returns only names and labels, behind the same two gates as the registry
methods and held in memory for an hour. Its labels are English only, so
every one of the 661 has a translation in each of the eight other
languages, in its own file keyed by permission name and loaded only when
Roles opens. A permission a later Stalwart adds shows its English label. A
test holds every language to the 0.16.22 snapshot: nothing missing, nothing
stale.

The mock answers x:Role/set with the grant check, loops and in-use
refusals, reads the defaults from x:Authentication, and serves the schema
gzipped as the real one is.

Fifty-two new strings and two plurals in all nine catalogues, and 661
permission labels with 59 headings in each of the eight translations.

web/src/locales/zh-Hans.ts

@@ -197,6 +197,58 @@ export const catalog: Catalog = {
     "Your organisation has reached the number of mailing lists it is allowed.": "您的组织已达到允许的邮件列表数量。",
     "This mailing list no longer exists. Someone may have deleted it.": "此邮件列表已不存在。可能已被他人删除。",
     "The server did not say whether the list was created.": "服务器未说明列表是否已创建。",
+    "Roles": "角色",
+    "users": "用户",
+    "groups": "群组",
+    "tenant administrators": "租户管理员",
+    "administrators": "管理员",
+    "A role needs a name.": "角色需要一个名称。",
+    "Created {name}": "已创建 {name}",
+    "New role": "新建角色",
+    "This role carries permissions yours doesn't, so you can view it but not change it.": "此角色拥有您的角色所没有的权限，因此您可以查看但不能更改。",
+    "Your role lets you view roles but not change them.": "您的角色可以查看角色，但不能更改。",
+    "Stalwart gives this role by default to {kinds}. A change here reaches everyone who has it that way.": "Stalwart 默认将此角色授予 {kinds}。此处的更改会影响所有以这种方式获得它的人。",
+    "Builds on": "基于",
+    "Permissions": "权限",
+    "Stalwart gives this role by default, so it can't be deleted. Change the defaults in Stalwart's own administration first.": "Stalwart 默认授予此角色，因此无法删除。请先在 Stalwart 自身的管理界面中更改默认设置。",
+    "This role carries permissions yours doesn't.": "此角色拥有您的角色所没有的权限。",
+    "Create role": "创建角色",
+    "builds on this one": "基于此角色",
+    "has permissions yours doesn't": "拥有您的角色所没有的权限",
+    "No other roles": "没有其他角色",
+    "A role has every permission of the roles it builds on, apart from any it or they deny.": "角色拥有其所基于角色的全部权限，但它或它们拒绝的权限除外。",
+    "Search permissions": "搜索权限",
+    "All permissions": "所有权限",
+    "Granted": "已授予",
+    "Set on this role": "在此角色上设置",
+    "No permissions match": "没有匹配的权限",
+    "{granted} of {total}": "{granted}/{total}",
+    "Denied by {role}": "被 {role} 拒绝",
+    "Granted by {role}": "由 {role} 授予",
+    "Inherit": "继承",
+    "Not set": "未设置",
+    "Allow": "允许",
+    "Deny": "拒绝",
+    "A denial wins over anything allowed, here or on a role this one builds on. You can only allow permissions you hold yourself.": "拒绝优先于任何允许，无论是在此处还是在此角色所基于的角色上。您只能允许自己拥有的权限。",
+    "Accounts, groups and other roles that use it must be moved off it first.": "必须先让使用它的账户、群组和其他角色改用别的角色。",
+    "Delete role…": "删除角色…",
+    "Deleted {name}": "已删除 {name}",
+    "Still used by {things}. Move them to another role first.": "仍被 {things} 使用。请先为它们分配其他角色。",
+    "Delete role": "删除角色",
+    "It can't be undone.": "此操作无法撤销。",
+    "Type {name} to confirm": "输入 {name} 以确认",
+    "Stalwart's list of permissions could not be loaded, so permissions can't be changed here. ({reason})": "无法加载 Stalwart 的权限列表，因此无法在此更改权限。（{reason}）",
+    "Named sets of permissions, given to accounts, groups and tenants.": "命名的权限集合，授予账户、群组和租户。",
+    "Search roles": "搜索角色",
+    "No roles match": "没有匹配的角色",
+    "No roles yet": "还没有角色",
+    "Open {name}": "打开 {name}",
+    "Default for {kinds}": "默认授予：{kinds}",
+    "You can't give a role permissions your own role doesn't have.": "您不能给角色授予您自己的角色所没有的权限。",
+    "Your organisation has reached the number of roles it is allowed.": "您的组织已达到允许的角色数量。",
+    "This role no longer exists. Someone may have deleted it.": "此角色已不存在。可能已被他人删除。",
+    "the default roles": "默认角色设置",
+    "The server did not say whether the role was created.": "服务器未说明角色是否已创建。",
     "User": "用户",
     "Administrator": "管理员",
     "Custom role": "自定义角色",
@@ -1602,6 +1654,8 @@ export const catalog: Catalog = {
     "Its {n} members are taken out of the group first, and lose what was shared with it. The group's own mail is removed in the background, and it can't be undone.": { other: "会先将 {n} 位成员移出群组，他们将失去与群组共享的内容。群组的邮件会在后台删除，且无法撤销。" },
     "{n} mailing lists": { other: "{n} 个邮件列表" },
     "{n} recipients": { other: "{n} 位收件人" },
+    "Grants {n} permissions": { other: "授予 {n} 项权限" },
+    "{n} roles": { other: "{n} 个角色" },
     "{n} DKIM keys": { other: "{n} 个 DKIM 密钥" },
     "{n} other items": { other: "其他 {n} 项" },
     // ── Administration ────────────────────────────────────────────────