Apply installation policy changes once each, per account

The last third of #207, and the only part that remembers anything.

An admin turns a setting on for people who are already here -- which a default
cannot do, since a default only seeds an account that has none -- and readers
may still turn it back off afterwards, which enforcement does not allow. The
difference between the two is entirely in the remembering.

Each change carries its own version, and an account stores the ones it has had
in its own settings file. Ids rather than a high-water mark, so a change dated
earlier than one already applied is not silently skipped -- the reporter's
analogy is a schema migration, and this is that shape.

Per account rather than per device, because ihasmail's settings are not
browser-local: they live in a file in the reader's own JMAP Files, with the
browser holding a cache. Signing in on a phone does not apply everything a
second time.

A change reaches somebody who had already decided otherwise. That is intended
and confirmed on the issue: the point is to reach everybody who is already
here. It is applied once, and their next decision sticks.

One `update` for however many are pending, since each would otherwise push a
settings file of its own. Enforced values still win, being applied after. A
change whose settings this build does not have at all is dropped rather than
recorded, or it would never run on the ihasmail that does have them.

The reader is told. A setting moving under somebody without a word is the part
of this worth being uneasy about, so the count is toasted with a way into
Settings.

README gains the Docker half the user asked for: a mounted policy file, the
same thing as environment variables for a deployment with no volume, a compose
fragment, and the fact that a policy is read once at startup so editing it
means a restart.

Closes #207.

server/src/config.ts

@@ -124,12 +124,16 @@ if (immutable) assertImmutable(sessionFile, fileURLToPath(new URL("../..", impor
  * - `enforced` are applied on every load and cannot be changed here at all. The
  *   controls stay visible and go dead, which the issue asked for by name: a
  *   missing control confuses somebody who has used ihasmail elsewhere.
+ * - `changes` are applied once each, to everybody, including accounts that
+ *   already exist -- and can be changed back afterwards. Each carries its own
+ *   `version`, which is how an account remembers the ones it has had. The
+ *   reporter's own analogy is a schema migration and this is that shape.
  *
  * Read from a file or straight from the environment, because ihasmail's own
  * production runs read-only with no volume -- an installation that cannot mount
  * a file can still set a variable.
  */
-function readSettingsPolicy(): { defaults: Record<string, unknown>; enforced: Record<string, unknown> } {
+function readSettingsPolicy(): { defaults: Record<string, unknown>; enforced: Record<string, unknown>; changes: Array<{ version: string; settings: Record<string, unknown> }> } {
   const parse = (raw: string, where: string): Record<string, unknown> => {
     try {
       const v = JSON.parse(raw) as unknown;
@@ -142,6 +146,30 @@ function readSettingsPolicy(): { defaults: Record<string, unknown>; enforced: Re
     }
   };
 
+  /**
+   * A change list, checked rather than trusted.
+   *
+   * Every entry needs a `version` that is unique within the file: it is what an
+   * account stores to say it has had this one, so a duplicate would make two
+   * changes indistinguishable and a missing one would apply for ever.
+   */
+  const parseChanges = (v: unknown, where: string): Array<{ version: string; settings: Record<string, unknown> }> => {
+    if (v === undefined) return [];
+    if (!Array.isArray(v)) throw new Error(`Invalid ${where}: "changes" must be a list`);
+    const seen = new Set<string>();
+    return v.map((entry, i) => {
+      const e = entry as { version?: unknown; settings?: unknown };
+      const version = typeof e.version === "string" ? e.version.trim() : "";
+      if (!version) throw new Error(`Invalid ${where}: changes[${i}] has no "version"`);
+      if (seen.has(version)) throw new Error(`Invalid ${where}: two changes share the version "${version}"`);
+      seen.add(version);
+      if (!e.settings || typeof e.settings !== "object" || Array.isArray(e.settings)) {
+        throw new Error(`Invalid ${where}: changes[${i}] ("${version}") has no "settings" object`);
+      }
+      return { version, settings: e.settings as Record<string, unknown> };
+    });
+  };
+
   const file = process.env.SETTINGS_POLICY_FILE;
   if (file) {
     if (!existsSync(file)) throw new Error(`SETTINGS_POLICY_FILE does not exist: ${file}`);
@@ -149,11 +177,13 @@ function readSettingsPolicy(): { defaults: Record<string, unknown>; enforced: Re
     return {
       defaults: (whole.defaults as Record<string, unknown>) ?? {},
       enforced: (whole.enforced as Record<string, unknown>) ?? {},
+      changes: parseChanges(whole.changes, `SETTINGS_POLICY_FILE (${file})`),
     };
   }
   return {
     defaults: process.env.SETTINGS_DEFAULTS ? parse(process.env.SETTINGS_DEFAULTS, "SETTINGS_DEFAULTS") : {},
     enforced: process.env.SETTINGS_ENFORCED ? parse(process.env.SETTINGS_ENFORCED, "SETTINGS_ENFORCED") : {},
+    changes: process.env.SETTINGS_CHANGES ? parseChanges(JSON.parse(process.env.SETTINGS_CHANGES), "SETTINGS_CHANGES") : [],
   };
 }